# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Tanium addressed an unauthorized code execution vulnerability in Comply.](https://agentprime.io/advisories/CVE-2026-87021.md)
  `CVE-2026-87021` · CVE record: Tanium Comply · CVSS 7.2 High · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection
- [An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram\_…](https://agentprime.io/advisories/CVE-2026-71614.md)
  `CVE-2026-71614` · CVE record · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection
- [An issue in Actions Semiconductor Co.](https://agentprime.io/advisories/CVE-2026-36433.md)
  `CVE-2026-36433` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection
- [Local Privilege Escalation in Auth0 AD/LDAP Connector](https://agentprime.io/advisories/CVE-2026-85983.md)
  `CVE-2026-85983` · CVE record: Auth0 Auth0 AD/LDAP Connector · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration](https://agentprime.io/advisories/CVE-2026-78625.md)
  `CVE-2026-78625` · CVE record: Okta Okta Access Gateway · CVSS 6.7 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Improper Input Handling in Okta Access Gateway Management Console Exception Handler](https://agentprime.io/advisories/CVE-2026-78550.md)
  `CVE-2026-78550` · CVE record: Okta Okta Access Gateway · CVSS 6.6 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Improper Input Sanitization in Okta Access Gateway Application Label Configuration](https://agentprime.io/advisories/CVE-2026-78545.md)
  `CVE-2026-78545` · CVE record: Okta Okta Access Gateway · CVSS 6.6 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)](https://agentprime.io/advisories/CVE-2026-48273.md)
  `CVE-2026-48273` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)](https://agentprime.io/advisories/CVE-2026-76190.md)
  `CVE-2026-76190` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE](https://agentprime.io/advisories/GHSA-284h-m62q-gf8w.md)
  `GHSA-284h-m62q-gf8w`, `CVE-2026-78676`, `PYSEC-2026-3786` · PyPI `gitpython`: affected `<3.1.59`, fixed in `3.1.59` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Command injection, Code injection
- [Gitea: Remote Code Execution via diffpatch Git Hook Installation](https://agentprime.io/advisories/GHSA-rcr6-4jqh-j84m.md)
  `GHSA-rcr6-4jqh-j84m`, `BIT-gitea-2026-60004`, `CVE-2026-60004`, `GO-2026-6433` · Go `gitea.dev`: affected `>=1.17.0, <1.27.1`, fixed in `1.27.1` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.24 · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [.NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69806.md)
  `CVE-2026-69806` · CVE record: Microsoft .NET 10.0 runtime and 4 more · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection, Information disclosure
- [Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-76191.md)
  `CVE-2026-76191` · CVE record: Adobe Adobe Animate 2023 and 1 more · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [InstantCMS has Remote Code Execution in package installer](https://agentprime.io/advisories/CVE-2026-54611.md)
  `CVE-2026-54611` · CVE record: instantsoft icms2 · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection, Unrestricted file upload
- [Remote Desktop Client Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-78463.md)
  `CVE-2026-78463` · CVE record: Microsoft Remote Desktop client for Windows Desktop · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-77908.md)
  `CVE-2026-77908` · CVE record: Microsoft Microsoft Dynamics 365 Customer Engagement V9.1 · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [aircheng-org iWebShop-5 pic.php uploadFile cross site scripting](https://agentprime.io/advisories/CVE-2026-86668.md)
  `CVE-2026-86668` · CVE record: aircheng-org iWebShop-5 · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Craft CMS before 5.10.12 Remote Code Execution via element-index](https://agentprime.io/advisories/CVE-2026-86732.md)
  `CVE-2026-86732` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE](https://agentprime.io/advisories/CVE-2026-86730.md)
  `CVE-2026-86730` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0](https://agentprime.io/advisories/CVE-2026-33387.md)
  `CVE-2026-33387` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [star7th showdoc API Page Save Endpoint editormd.js cross site scripting](https://agentprime.io/advisories/CVE-2026-86644.md)
  `CVE-2026-86644` · CVE record: star7th showdoc · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2026-18021.md)
  `CVE-2026-18021` · CVE record: beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Code injection in Siemens Desigo CC ClickOnce Client V6 and others](https://agentprime.io/advisories/CVE-2026-34223.md)
  `CVE-2026-34223` · CVE record: Siemens Desigo CC ClickOnce Client V6 and 4 more · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message.](https://agentprime.io/advisories/CVE-2026-79574.md)
  `CVE-2026-79574` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions.](https://agentprime.io/advisories/CVE-2026-78971.md)
  `CVE-2026-78971` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin.](https://agentprime.io/advisories/CVE-2026-78834.md)
  `CVE-2026-78834` · CVE record · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)](https://agentprime.io/advisories/CVE-2026-75650.md)
  `CVE-2026-75650` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 7 Sept 2026 · Tags: Code injection
- [Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field](https://agentprime.io/advisories/CVE-2026-12757.md)
  `CVE-2026-12757` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Code injection
- [Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service](https://agentprime.io/advisories/CVE-2026-79678.md)
  `CVE-2026-79678` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 7 Sept 2026 · Tags: Code injection
- [code-projects Hospital Information System Patient Management editPatient.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86301.md)
  `CVE-2026-86301` · CVE record: code-projects Hospital Information System · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86294.md)
  `CVE-2026-86294` · CVE record: SourceCodester Simple Traffic Offense System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86278.md)
  `CVE-2026-86278` · CVE record: SourceCodester Syllabus-Aligned Learning Management & Examination System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [sfturing ssm_pro Order Endpoint OrderController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-86264.md)
  `CVE-2026-86264` · CVE record: sfturing ssm_pro · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [FastAdmin User Controller User.php login cross site scripting](https://agentprime.io/advisories/CVE-2026-86244.md)
  `CVE-2026-86244` · CVE record: FastAdmin · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [projectworlds Online Examination System Feedback Form feedback.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86238.md)
  `CVE-2026-86238` · CVE record: projectworlds Online Examination System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Projectwolds Online Attendance System profile.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86226.md)
  `CVE-2026-86226` · CVE record: Projectwolds Online Attendance System · CVSS 5.1 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86216.md)
  `CVE-2026-86216` · CVE record: code-projects Hotel and Tourism Reservation in PHP · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds](https://agentprime.io/advisories/CVE-2026-86242.md)
  `CVE-2026-86242` · CVE record: maximhq Bifrost · CVSS 8.1 High · Not analysed yet · Published 6 Sept 2026 · Tags: Code injection, Broken access control, Authentication bypass
- [code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86181.md)
  `CVE-2026-86181` · CVE record: code-projects Task Management System · CVSS 5.1 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [pre-authentication remote code execution](https://agentprime.io/advisories/CVE-2026-86218.md)
  `CVE-2026-86218` · CVE record: N-able N-central · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.15 · Not analysed yet · Published 6 Sept 2026 · Tags: Code injection
- [Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection](https://agentprime.io/advisories/CVE-2024-11080.md)
  `CVE-2024-11080` · CVE record: pickplugins Post Grid · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Code injection
- [Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log](https://agentprime.io/advisories/CVE-2026-83627.md)
  `CVE-2026-83627` · CVE record: wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Code injection
- [CodeWhale: Project config \`allow_shell\` override enables arbitrary shell command execution via cloned repository](https://agentprime.io/advisories/GHSA-gx45-xrj5-g6c4.md)
  `GHSA-gx45-xrj5-g6c4`, `CVE-2026-75911` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)](https://agentprime.io/advisories/GHSA-wrj3-vj8c-784f.md)
  `GHSA-wrj3-vj8c-784f`, `CVE-2026-75858` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection, Broken access control
- [Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server](https://agentprime.io/advisories/CVE-2026-85654.md)
  `CVE-2026-85654` · CVE record: Amazon awslabs.dynamodb-mcp-server · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-13297.md)
  `CVE-2026-13297` · CVE record: IBM Verify Identity Access and 3 more · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint](https://agentprime.io/advisories/CVE-2026-19298.md)
  `CVE-2026-19298` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [LaVague 0.2.35 Remote Code Execution via eval extraction](https://agentprime.io/advisories/CVE-2026-85694.md)
  `CVE-2026-85694` · CVE record: lavague-ai LaVague · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [aider 0.86.2 Remote Code Execution via .aider.conf.yml](https://agentprime.io/advisories/CVE-2026-85674.md)
  `CVE-2026-85674` · CVE record: Aider-AI aider · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [goose 1.37.0 Arbitrary Command Execution via Recipe Extensions](https://agentprime.io/advisories/CVE-2026-85623.md)
  `CVE-2026-85623` · CVE record: aaif-goose goose · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [OpenPanel before 2.3.0 Remote Code Execution via chart formulas](https://agentprime.io/advisories/CVE-2026-85610.md)
  `CVE-2026-85610` · CVE record: Openpanel-dev openpanel · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [Grav before 2.0.18 Remote Code Execution via sort filter](https://agentprime.io/advisories/CVE-2026-85604.md)
  `CVE-2026-85604` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite](https://agentprime.io/advisories/CVE-2026-19224.md)
  `CVE-2026-19224` · CVE record: Unknown Hummingbird Performance · CVSS 7.2 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [Eleveo Quality Management Conversation Review cross site scripting](https://agentprime.io/advisories/CVE-2026-85406.md)
  `CVE-2026-85406` · CVE record: Eleveo Quality Management · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Eleveo Call Recording Software roleAddAction.do cross site scripting](https://agentprime.io/advisories/CVE-2026-85405.md)
  `CVE-2026-85405` · CVE record: Eleveo Call Recording Software · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting](https://agentprime.io/advisories/CVE-2026-85382.md)
  `CVE-2026-85382` · CVE record: light0011 cms · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php…](https://agentprime.io/advisories/CVE-2026-71624.md)
  `CVE-2026-71624` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions.](https://agentprime.io/advisories/CVE-2026-31020.md)
  `CVE-2026-31020` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel](https://agentprime.io/advisories/GHSA-x67c-8pwr-m8g3.md)
  `GHSA-x67c-8pwr-m8g3`, `CVE-2026-72807`, `GO-2026-6410` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260723035036-0a176345e02a`, fixed in `0.0.0-20260723035036-0a176345e02a` · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection, Code injection
- [Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)](https://agentprime.io/advisories/GHSA-fg9p-mrxr-hvq7.md)
  `GHSA-fg9p-mrxr-hvq7`, `CVE-2026-62681` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA5LTAzVDE5OjE3OjMyLjAwMDAwMFoiLCJHSFNBLWZnOXAtbXJ4ci1odnE3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTA5LTA5VDEwOjMxOjU1Ljg2MzAwMFoiLCJDVkUtMjAyNi04NTk3OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTA5LTA5VDEwOjMxOjU1Ljg2MzAwMFoiLCJDVkUtMjAyNi04NTk3OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.