# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection](https://agentprime.io/advisories/CVE-2026-78166.md)
  `CVE-2026-78166` · CVE record: provectus kafka-ui · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Other injection, Code injection
- [An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c](https://agentprime.io/advisories/CVE-2026-52490.md)
  `CVE-2026-52490` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection
- [In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.](https://agentprime.io/advisories/CVE-2025-26238.md)
  `CVE-2025-26238` · CVE record · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection
- [Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine](https://agentprime.io/advisories/CVE-2026-78140.md)
  `CVE-2026-78140` · CVE record: Dromara UJCMS · CVSS 5.1 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Code injection, CWE-791
- [SourceCodester Stock Management System getOrderReport.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78060.md)
  `CVE-2026-78060` · CVE record: SourceCodester Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Stock Management System printOrder.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78059.md)
  `CVE-2026-78059` · CVE record: SourceCodester Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78055.md)
  `CVE-2026-78055` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Eval injection in CHIRP](https://agentprime.io/advisories/CVE-2026-78136.md)
  `CVE-2026-78136` · CVE record: chirpmyradio CHIRP · CVSS 7.8 High · Not analysed yet · Published 23 Aug 2026 · Tags: Code injection
- [SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78054.md)
  `CVE-2026-78054` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76605.md)
  `CVE-2026-76605` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-77992.md)
  `CVE-2026-77992` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76604.md)
  `CVE-2026-76604` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter](https://agentprime.io/advisories/CVE-2026-3424.md)
  `CVE-2026-3424` · CVE record: properfraction kk Star Ratings – Rate Post & Collect User Feedbacks · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite](https://agentprime.io/advisories/CVE-2026-19221.md)
  `CVE-2026-19221` · CVE record: Unknown Forminator Forms · CVSS 7.2 High · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions](https://agentprime.io/advisories/GHSA-66mm-25pp-rfff.md)
  `GHSA-66mm-25pp-rfff`, `CVE-2026-77415` · npm `jsonata`: affected `<1.8.8 || >=2.0.0, <2.2.1`, fixed in `1.8.8`, `2.2.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions](https://agentprime.io/advisories/GHSA-2943-5xfg-gq5f.md)
  `GHSA-2943-5xfg-gq5f`, `CVE-2026-77414` · npm `jsonata`: affected `<1.8.8 || >=2.0.0, <2.2.1`, fixed in `1.8.8`, `2.2.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Hydra: hydra.utils.instantiate with untrusted config can lead to code execution](https://agentprime.io/advisories/GHSA-2cp2-2r3c-7p7r.md)
  `GHSA-2cp2-2r3c-7p7r`, `CVE-2026-68508`, `PYSEC-2026-3850` · PyPI `hydra-core`: affected `<1.3.4`, fixed in `1.3.4` · CVSS 7.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [JSONata: Arbitrary Code Execution via crafted JSONata expressions](https://agentprime.io/advisories/GHSA-8gq3-vp5j-2grp.md)
  `GHSA-8gq3-vp5j-2grp`, `CVE-2026-77413` · npm `jsonata`: affected `<1.8.8 || >=2.0.0, <2.2.0`, fixed in `1.8.8`, `2.2.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Xinference vulnerable to remote code execution via unsafe \`eval()\` in Llama3 tool-call parsing](https://agentprime.io/advisories/GHSA-x2rj-828p-hx9m.md)
  `GHSA-x2rj-828p-hx9m`, `CVE-2026-61539`, `PYSEC-2026-3946` · PyPI `xinference`: affected `<2.7.0`, fixed in `2.7.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Phalcon Volt compiler \`join\` filter compile-time PHP code injection (SSTI leads to RCE)](https://agentprime.io/advisories/GHSA-hrwp-4hh9-c8r8.md)
  `GHSA-hrwp-4hh9-c8r8`, `CVE-2026-59989`, `PKSA-n2s8-x5tr-m78t` · Packagist `phalcon/cphalcon`: affected `<5.16.0`, fixed in `5.16.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector](https://agentprime.io/advisories/CVE-2026-77810.md)
  `CVE-2026-77810` · CVE record: AWS Athena Federated Query Neptune Connector · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Code injection in SPIP](https://agentprime.io/advisories/CVE-2026-77806.md)
  `CVE-2026-77806` · CVE record: SPIP SPIP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass](https://agentprime.io/advisories/CVE-2026-18781.md)
  `CVE-2026-18781` · CVE record: Unknown Drag and Drop Multiple File Upload for Contact Form 7 · CVSS 8.1 High · Not analysed yet · Published 21 Aug 2026 · Tags: Code injection
- [Code injection in SPIP](https://agentprime.io/advisories/CVE-2026-77647.md)
  `CVE-2026-77647` · CVE record: SPIP SPIP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-18287.md)
  `CVE-2026-18287` · CVE record: aeon aeon · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-18286.md)
  `CVE-2026-18286` · CVE record: aeon aeon · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php](https://agentprime.io/advisories/CVE-2026-76635.md)
  `CVE-2026-76635` · CVE record: baserproject basercms · CVSS 8.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection, Code injection
- [@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag](https://agentprime.io/advisories/CVE-2026-76833.md)
  `CVE-2026-76833` · CVE record: cgauge @cgauge/yaml · CVSS 8.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-73992.md)
  `CVE-2026-73992` · CVE record: Jonathan Daggerhart Query Wrangler · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution](https://agentprime.io/advisories/CVE-2026-77077.md)
  `CVE-2026-77077` · CVE record: n8n-io n8n · CVSS 7.2 High · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [n8n before 1.123.69 Expression Injection via Resource Locator](https://agentprime.io/advisories/CVE-2026-77075.md)
  `CVE-2026-77075` · CVE record: n8n-io n8n · CVSS 8.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [n8n before 1.123.69 SSRF via Edit Image Node](https://agentprime.io/advisories/CVE-2026-77074.md)
  `CVE-2026-77074` · CVE record: n8n-io n8n · CVSS 6.0 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder](https://agentprime.io/advisories/CVE-2026-13405.md)
  `CVE-2026-13405` · CVE record: Unknown Royal Addons for Elementor · CVSS 6.6 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Code injection
- [chenhg5 cc-connect webhook.go authenticate code injection](https://agentprime.io/advisories/CVE-2026-76760.md)
  `CVE-2026-76760` · CVE record: chenhg5 cc-connect · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Code injection
- [Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76335.md)
  `CVE-2026-76335` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Code Injection through Splunk Web Manager Configuration in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76315.md)
  `CVE-2026-76315` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76314.md)
  `CVE-2026-76314` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Logto: OS command injection vulnerability exists in the Commitlint workflow](https://agentprime.io/advisories/CVE-2026-63187.md)
  `CVE-2026-63187` · CVE record: logto-io logto · CVSS 6.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)](https://agentprime.io/advisories/GHSA-w47q-945m-q9pc.md)
  `GHSA-w47q-945m-q9pc`, `CVE-2026-53964`, `PYSEC-2026-3830` · PyPI `document-merge-service`: affected `<9.1.0`, fixed in `9.1.0` · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Copier has a trust-prefix bypass via path traversal that runs tasks unprompted](https://agentprime.io/advisories/GHSA-9gmc-jqmh-3rvm.md)
  `GHSA-9gmc-jqmh-3rvm`, `CVE-2026-53951`, `PYSEC-2026-3818` · PyPI `copier`: affected `>=9.5.0, <9.15.2`, fixed in `9.15.2` · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal, Code injection
- [Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription](https://agentprime.io/advisories/CVE-2026-18874.md)
  `CVE-2026-18874` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [marimo < 0.23.15 Code Injection via MCP Server Configuration](https://agentprime.io/advisories/CVE-2026-75149.md)
  `CVE-2026-75149` · CVE record: marimo-team marimo · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Code injection in TrueConf Server](https://agentprime.io/advisories/CVE-2026-72530.md)
  `CVE-2026-72530` · CVE record: TrueConf TrueConf Server · CVSS 9.5 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution](https://agentprime.io/advisories/CVE-2026-53451.md)
  `CVE-2026-53451` · CVE record: sgoudelis ground-station · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal, Code injection
- [MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File](https://agentprime.io/advisories/CVE-2026-45272.md)
  `CVE-2026-45272` · CVE record: PoxenStudio talebook · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection, CWE-829
- [Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution](https://agentprime.io/advisories/CVE-2026-43961.md)
  `CVE-2026-43961` · CVE record: vim vim and 4 more · CVSS 7.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback](https://agentprime.io/advisories/CVE-2026-76224.md)
  `CVE-2026-76224` · CVE record: ArcadeData arcadedb · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2](https://agentprime.io/advisories/CVE-2026-67364.md)
  `CVE-2026-67364` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-66613.md)
  `CVE-2026-66613` · CVE record: Crocoblock. Jetimpex Inc. JetEngine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection](https://agentprime.io/advisories/CVE-2026-18937.md)
  `CVE-2026-18937` · CVE record: Unknown Broken Link Checker · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection
- [xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine](https://agentprime.io/advisories/CVE-2026-75979.md)
  `CVE-2026-75979` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection, CWE-791
- [jmespath.php has CompilerRuntime code injection via unescaped function names](https://agentprime.io/advisories/GHSA-pcw8-m77r-2528.md)
  `GHSA-pcw8-m77r-2528`, `CVE-2026-54133`, `PKSA-mnyp-475s-ywph` · Packagist `mtdowling/jmespath.php`: affected `<2.9.1`, fixed in `2.9.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection, CWE-20, CWE-116
- [kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)](https://agentprime.io/advisories/GHSA-7pwq-q9jf-539h.md)
  `GHSA-7pwq-q9jf-539h`, `CVE-2026-55107` · RubyGems `kobako`: affected `>=0.1.0, <0.9.1`, fixed in `0.9.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [Server-side template injection in Integrated Publishing Toolkit](https://agentprime.io/advisories/CVE-2026-71880.md)
  `CVE-2026-71880` · CVE record: GBIF Integrated Publishing Toolkit · CVSS 7.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading](https://agentprime.io/advisories/GHSA-6g32-pxv4-2wfj.md)
  `GHSA-6g32-pxv4-2wfj`, `CVE-2026-63337` · Maven `com.rabbitmq:amqp-client`: affected `<5.33.0`, fixed in `5.33.0` · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [MyBB: Installer database configuration RCE](https://agentprime.io/advisories/CVE-2026-45117.md)
  `CVE-2026-45117` · CVE record: mybb mybb · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [Vim: Arbitrary Ex Command Execution in C Omni-Completion](https://agentprime.io/advisories/CVE-2026-73073.md)
  `CVE-2026-73073` · CVE record: vim vim · CVSS 7.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection, CWE-829
- [Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files](https://agentprime.io/advisories/CVE-2026-50187.md)
  `CVE-2026-50187` · CVE record: ohmyzsh ohmyzsh · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-73343.md)
  `CVE-2026-73343` · CVE record: AresIT WP Compress · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-32444.md)
  `CVE-2026-32444` · CVE record: Cwicly Cwicly · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA4LTE4VDEzOjU5OjExLjM5NTAwMFoiLCJDVkUtMjAyNi0zMjQ0NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTA4LTI0VDAyOjQ1OjA4Ljc4MzAwMFoiLCJDVkUtMjAyNi03ODE3OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTA4LTI0VDAyOjQ1OjA4Ljc4MzAwMFoiLCJDVkUtMjAyNi03ODE3OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.