# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint](https://agentprime.io/advisories/CVE-2026-58454.md)
  `CVE-2026-58454` · CVE record: JAIOTlink C492A-W6 Wi-Fi IP Camera · CVSS 7.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection
- [Remote Code Execution via Unsafe Deserialization in LogItem Import](https://agentprime.io/advisories/CVE-2026-58025.md)
  `CVE-2026-58025` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection, Insecure deserialization
- [Full RCE using EasyTimeline Extension](https://agentprime.io/advisories/CVE-2026-8857.md)
  `CVE-2026-8857` · CVE record: Wikimedia Foundation timeline · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection
- [Code injection in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24249.md)
  `CVE-2026-24249` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection
- [Code injection in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24248.md)
  `CVE-2026-24248` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection
- [Unsafe reflection in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24246.md)
  `CVE-2026-24246` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection
- [Langflow: Code Injection Vulnerability in Code Validation Endpoint](https://agentprime.io/advisories/GHSA-v798-mcc6-2m3m.md)
  `GHSA-v798-mcc6-2m3m`, `CVE-2026-7873` · PyPI `langflow`: affected `>=1.0.0, <1.10.1.rc0`, fixed in `1.10.1.rc0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter](https://agentprime.io/advisories/CVE-2026-58449.md)
  `CVE-2026-58449` · CVE record: neuml txtai · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling](https://agentprime.io/advisories/CVE-2026-10109.md)
  `CVE-2026-10109` · CVE record: IBM Db2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows](https://agentprime.io/advisories/CVE-2026-10134.md)
  `CVE-2026-10134` · CVE record: IBM Langflow OSS · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [IBM WebSphere eXtreme Scale's OQL is affected by remote code execution](https://agentprime.io/advisories/CVE-2026-13772.md)
  `CVE-2026-13772` · CVE record: IBM WebSphere Extreme Scale · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators](https://agentprime.io/advisories/CVE-2026-58138.md)
  `CVE-2026-58138` · CVE record: conductor-oss conductor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [Code injection in Siemens Mendix Studio Pro 10.11 and others](https://agentprime.io/advisories/CVE-2026-48192.md)
  `CVE-2026-48192` · CVE record: Siemens Mendix Studio Pro 10.11 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection
- [LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path](https://agentprime.io/advisories/CVE-2026-58116.md)
  `CVE-2026-58116` · CVE record: hiyouga LlamaFactory · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Code injection, CWE-829
- [Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection](https://agentprime.io/advisories/CVE-2026-13749.md)
  `CVE-2026-13749` · CVE record: Snowflake Snowflake CLI · CVSS 8.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [SourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting](https://agentprime.io/advisories/CVE-2026-13570.md)
  `CVE-2026-13570` · CVE record: SourceCodester Inventory Management System · CVSS 5.1 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Online Music Site POST Request Feedback.php cross site scripting](https://agentprime.io/advisories/CVE-2026-13567.md)
  `CVE-2026-13567` · CVE record: code-projects Online Music Site · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution](https://agentprime.io/advisories/GHSA-f49j-v924-fx9w.md)
  `GHSA-f49j-v924-fx9w`, `CVE-2026-44181`, `PYSEC-2026-364` · PyPI `jupyter-enterprise-gateway`: affected `>=2.0.0rc2, <3.3.0`, fixed in `3.3.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [python-statemachine SCXML \<data expr> Eval Injection](https://agentprime.io/advisories/GHSA-v4jc-pm6r-3vj8.md)
  `GHSA-v4jc-pm6r-3vj8`, `CVE-2026-47103`, `PYSEC-2026-506` · PyPI `python-statemachine`: affected `>=3.0.0, <3.2.0`, fixed in `3.2.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [Salesforce Uni2TS has a Code Injection vulnerability](https://agentprime.io/advisories/GHSA-7x99-8x99-xc54.md)
  `GHSA-7x99-8x99-xc54`, `CVE-2026-22584`, `PYSEC-2026-557` · PyPI `uni2ts`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [Langroid has WAF Bypass Leading to RCE in TableChatAgent](https://agentprime.io/advisories/GHSA-x34r-63hx-w57f.md)
  `GHSA-x34r-63hx-w57f`, `CVE-2026-25481`, `PYSEC-2026-383` · PyPI `langroid`: affected `<0.59.32`, fixed in `0.59.32` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection](https://agentprime.io/advisories/GHSA-8xwf-cr4r-856r.md)
  `GHSA-8xwf-cr4r-856r`, `CVE-2026-28370`, `PYSEC-2026-564` · PyPI `vitrage`: affected `<12.0.1 || >=13.0.0.0rc1, <13.0.1 || >=14.0.0.0rc1, <14.0.1 || >=15.0.0.0rc1, <15.0.1`, fixed in `12.0.1`, `13.0.1`, `14.0.1`, `15.0.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [llm CLI tool contains a code injection vulnerability via \`--functions\` command-line argument](https://agentprime.io/advisories/GHSA-g76p-4vg5-f4qh.md)
  `GHSA-g76p-4vg5-f4qh`, `CVE-2026-31236`, `PYSEC-2026-400` · PyPI `llm`: affected `<=0.27.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [PraisonAI MCP \`tools/call\` path-traversal => RCE via Python \`.pth\` injection](https://agentprime.io/advisories/GHSA-9mqq-jqxf-grvw.md)
  `GHSA-9mqq-jqxf-grvw`, `CVE-2026-44336`, `PYSEC-2026-472` · PyPI `praisonai`: affected `<4.6.34`, fixed in `4.6.34` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Path traversal, Code injection, CWE-20, CWE-829
- [PySyft server-side arbitrary Python execution after code approval](https://agentprime.io/advisories/GHSA-cfpg-c974-jfhq.md)
  `GHSA-cfpg-c974-jfhq`, `CVE-2026-31220`, `PYSEC-2026-546` · PyPI `syft`: affected `<=0.9.5`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [PraisonAI's unauthenticated A2A official example can reach real LLM-driven \`eval()\` tool execution](https://agentprime.io/advisories/GHSA-vg22-4gmj-prxw.md)
  `GHSA-vg22-4gmj-prxw`, `CVE-2026-47391`, `PYSEC-2026-478` · PyPI `praisonai`: affected `<4.6.40`, fixed in `4.6.40` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection, Authentication bypass
- [PraisonAI has critical RCE via \`type: job\` workflow YAML](https://agentprime.io/advisories/GHSA-vc46-vw85-3wvm.md)
  `GHSA-vc46-vw85-3wvm`, `CVE-2026-40288`, `PYSEC-2026-477`, `PYSEC-2026-488` · PyPI `praisonai`: affected `<4.5.139`, fixed in `4.5.139` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection, Code injection
- [Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py](https://agentprime.io/advisories/GHSA-gjgx-rvqr-6w6v.md)
  `GHSA-gjgx-rvqr-6w6v`, `CVE-2026-33057`, `PYSEC-2026-412` · PyPI `mesop`: affected `<1.2.3`, fixed in `1.2.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint](https://agentprime.io/advisories/GHSA-vwmf-pq79-vjvx.md)
  `GHSA-vwmf-pq79-vjvx`, `CVE-2026-33017`, `PYSEC-2026-379` · PyPI `langflow`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.96 · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection, Authentication bypass
- [Code Injection in pyload-ng](https://agentprime.io/advisories/GHSA-pf38-5p22-x6h6.md)
  `GHSA-pf38-5p22-x6h6`, `CVE-2023-0297`, `PYSEC-2026-498` · PyPI `pyload-ng`: affected `<0.5.0b3.dev31`, fixed in `0.5.0b3.dev31` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.96 · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [vanna vulnerable to remote code execution caused by prompt injection](https://agentprime.io/advisories/GHSA-rrqq-fv6m-692m.md)
  `GHSA-rrqq-fv6m-692m`, `CVE-2024-5826`, `PYSEC-2026-562` · PyPI `vanna`: affected `<=0.6.2`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [LlamaIndex includes an exec call for \`import {cls_name}\`](https://agentprime.io/advisories/GHSA-fxc2-8m62-m85x.md)
  `GHSA-fxc2-8m62-m85x`, `CVE-2024-45201`, `PYSEC-2024-192`, `PYSEC-2026-395` · PyPI `llama-index-core`: affected `<0.10.38`, fixed in `0.10.38` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [Vanna prompt injection code execution](https://agentprime.io/advisories/GHSA-7735-w2jp-gvg6.md)
  `GHSA-7735-w2jp-gvg6`, `CVE-2024-5565`, `PYSEC-2026-561` · PyPI `vanna`: affected `<=0.5.5`, no fixed version yet · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [pgadmin4 has a Meta-Command Filter Command Execution](https://agentprime.io/advisories/GHSA-fxmw-jcgr-w44v.md)
  `GHSA-fxmw-jcgr-w44v`, `CVE-2025-13780`, `PYSEC-2026-450` · PyPI `pgadmin4`: affected `<9.11`, fixed in `9.11` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [Rasa Allows Remote Code Execution via Remote Model Loading](https://agentprime.io/advisories/GHSA-cpv4-ggrr-7j9v.md)
  `GHSA-cpv4-ggrr-7j9v`, `CVE-2024-49375`, `PYSEC-2026-513`, `PYSEC-2026-514` · PyPI `rasa`: affected `<3.6.21`, fixed in `3.6.21` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection, Insecure deserialization
- [smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module](https://agentprime.io/advisories/GHSA-6v92-r5mx-h5fx.md)
  `GHSA-6v92-r5mx-h5fx`, `CVE-2025-5120`, `PYSEC-2026-542` · PyPI `smolagents`: affected `<1.17.0`, fixed in `1.17.0` · CVSS 7.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode](https://agentprime.io/advisories/GHSA-w2p4-p4rh-qcm3.md)
  `GHSA-w2p4-p4rh-qcm3`, `CVE-2025-12762`, `PYSEC-2026-454` · PyPI `pgadmin4`: affected `<9.10`, fixed in `9.10` · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [pgAdmin 4 Vulnerable to Remote Code Execution](https://agentprime.io/advisories/GHSA-g73c-fw68-pwx3.md)
  `GHSA-g73c-fw68-pwx3`, `CVE-2025-2945`, `PYSEC-2026-451` · PyPI `pgadmin4`: affected `<9.2`, fixed in `9.2` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.56 · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [CodeAstro Complaint Management System Report addreport cross site scripting](https://agentprime.io/advisories/CVE-2026-13558.md)
  `CVE-2026-13558` · CVE record: CodeAstro Complaint Management System · CVSS 5.1 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting](https://agentprime.io/advisories/CVE-2026-13557.md)
  `CVE-2026-13557` · CVE record: itsourcecode Online Hotel Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting](https://agentprime.io/advisories/CVE-2026-13556.md)
  `CVE-2026-13556` · CVE record: itsourcecode Online Hotel Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting](https://agentprime.io/advisories/CVE-2026-13554.md)
  `CVE-2026-13554` · CVE record: itsourcecode Online Hotel Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [GotoHTTP reg.12x cross site scripting](https://agentprime.io/advisories/CVE-2026-13536.md)
  `CVE-2026-13536` · CVE record: GotoHTTP · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component](https://agentprime.io/advisories/CVE-2026-37637.md)
  `CVE-2026-37637` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection
- [code-projects Project Management System Mail Compose mail.php cross site scripting](https://agentprime.io/advisories/CVE-2026-13504.md)
  `CVE-2026-13504` · CVE record: code-projects Project Management System · CVSS 5.1 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [antlr ANTLR4 Grammar Action Block OutputFile.java code injection](https://agentprime.io/advisories/CVE-2026-13500.md)
  `CVE-2026-13500` · CVE record: antlr ANTLR4 · CVSS 6.9 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, Code injection
- [yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting](https://agentprime.io/advisories/CVE-2026-13499.md)
  `CVE-2026-13499` · CVE record: yashpokharna2555 restaurent-management-system · CVSS 5.3 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Statamic CMS's unsafe method invocation via collection sorting allows data destruction](https://agentprime.io/advisories/GHSA-m92m-r54r-x8r2.md)
  `GHSA-m92m-r54r-x8r2`, `CVE-2026-49287`, `PKSA-fhw5-pm86-31ff` · Packagist `statamic/cms`: affected `<5.73.23 || >=6.0.0, <6.20.0`, fixed in `5.73.23`, `6.20.0` · CVSS 7.4 High · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection
- [Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass](https://agentprime.io/advisories/CVE-2026-53576.md)
  `CVE-2026-53576` · CVE record: kestra-io kestra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection, Authentication bypass
- [Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in \`${tag}\` Placeholder](https://agentprime.io/advisories/GHSA-44hj-4m45-frj3.md)
  `GHSA-44hj-4m45-frj3`, `BIT-fluentd-2026-44024`, `CVE-2026-44024` · RubyGems `fluentd`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, Code injection
- [Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval](https://agentprime.io/advisories/CVE-2026-45406.md)
  `CVE-2026-45406` · CVE record: dokku dokku · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection
- [WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-57315.md)
  `CVE-2026-57315` · CVE record: Creative Themes Blocksy Companion Pro · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection
- [Code injection in Trellix Network Security NX, EX, FX, AX, and CMS](https://agentprime.io/advisories/CVE-2025-7958.md)
  `CVE-2025-7958` · CVE record: Trellix Trellix Network Security NX, EX, FX, AX, and CMS · CVSS 7.1 High · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection
- [Code injection in Revive Adserver](https://agentprime.io/advisories/CVE-2026-50741.md)
  `CVE-2026-50741` · CVE record: Revive Adserver · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection
- [MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments](https://agentprime.io/advisories/GHSA-qhmf-xw27-6rqr.md)
  `GHSA-qhmf-xw27-6rqr`, `CVE-2026-48517` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection, Insecure deserialization
- [MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows](https://agentprime.io/advisories/GHSA-382j-8mxh-c7x2.md)
  `GHSA-382j-8mxh-c7x2`, `CVE-2026-48502` · NuGet `MessagePack`: affected `>=3.0, <3.1.7`, fixed in `3.1.7` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption, Denial of service, Code injection, Insecure deserialization
- [ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution](https://agentprime.io/advisories/CVE-2026-55413.md)
  `CVE-2026-55413` · CVE record: ToolJet ToolJet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection
- [Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename](https://agentprime.io/advisories/CVE-2026-55895.md)
  `CVE-2026-55895` · CVE record: vim vim · CVSS 5.7 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Command injection, Code injection
- [Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings](https://agentprime.io/advisories/CVE-2026-57456.md)
  `CVE-2026-57456` · CVE record: vim vim · CVSS 8.4 High · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection
- [WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-56049.md)
  `CVE-2026-56049` · CVE record: Post Snippets Post Snippets · CVSS 8.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA2LTI1VDEzOjEyOjQxLjUyNDAwMFoiLCJDVkUtMjAyNi01NjA0OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTA3LTAxVDE3OjU2OjUxLjAwMDAwMFoiLCJHSFNBLTJ2NG0tZnc2Yy1nNzhmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTA3LTAxVDE3OjU2OjUxLjAwMDAwMFoiLCJHSFNBLTJ2NG0tZnc2Yy1nNzhmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.