# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution](https://agentprime.io/advisories/GHSA-f623-hjm8-5wg5.md)
  `GHSA-f623-hjm8-5wg5` · PyPI `vllm`: affected `>=0.7.3, <0.31.0`, fixed in `0.31.0` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 21 Oct 2026 · Tags: Code injection
- [itsourcecode Online Cake Ordering System 404.php cross site scripting](https://agentprime.io/advisories/CVE-2026-113741.md)
  `CVE-2026-113741` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [opensource-socialnetwork Cache Settings dynamic.php input code injection](https://agentprime.io/advisories/CVE-2026-113388.md)
  `CVE-2026-113388` · CVE record: opensource-socialnetwork · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Other injection, Code injection
- [Optimal IdM OptimalCloud Login cross site scripting](https://agentprime.io/advisories/CVE-2026-113383.md)
  `CVE-2026-113383` · CVE record: Optimal IdM OptimalCloud · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Code injection in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43857.md)
  `CVE-2026-43857` · CVE record: Advantech ADAM-3600 · CVSS 8.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Code injection
- [An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py](https://agentprime.io/advisories/CVE-2026-95168.md)
  `CVE-2026-95168` · CVE record · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Code injection
- [H3C Magic NX15 RPC esps write code injection](https://agentprime.io/advisories/CVE-2026-112371.md)
  `CVE-2026-112371` · CVE record: H3C Magic NX15 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout](https://agentprime.io/advisories/CVE-2026-112774.md)
  `CVE-2026-112774` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection](https://agentprime.io/advisories/CVE-2026-112773.md)
  `CVE-2026-112773` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection](https://agentprime.io/advisories/CVE-2026-112772.md)
  `CVE-2026-112772` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable](https://agentprime.io/advisories/CVE-2026-112770.md)
  `CVE-2026-112770` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting](https://agentprime.io/advisories/CVE-2026-112249.md)
  `CVE-2026-112249` · CVE record: grandnode grandnode2 · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting](https://agentprime.io/advisories/CVE-2026-112247.md)
  `CVE-2026-112247` · CVE record: Wuxi Wubang Security Software Five-in-One Safety Production Management Information System · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations](https://agentprime.io/advisories/CVE-2024-4412.md)
  `CVE-2024-4412` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 2.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [sqlparse through 0.6.0 PHP Code Injection via output_format='php'](https://agentprime.io/advisories/CVE-2026-112307.md)
  `CVE-2026-112307` · CVE record: andialbrecht sqlparse · CVSS 8.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Camunda Expression Injection via orQueries RCE](https://agentprime.io/advisories/CVE-2026-109432.md)
  `CVE-2026-109432` · CVE record: Camunda Camunda 7 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Command injection, Code injection
- [speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager.\_load_fn externally-controlled input to select classes or code](https://agentprime.io/advisories/CVE-2026-112145.md)
  `CVE-2026-112145` · CVE record: speaches-ai speaches · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [llSourcell Doctor-Dignity chat_module.py \_get_lib_module code injection](https://agentprime.io/advisories/CVE-2026-112140.md)
  `CVE-2026-112140` · CVE record: llSourcell Doctor-Dignity · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON](https://agentprime.io/advisories/CVE-2026-71253.md)
  `CVE-2026-71253` · CVE record: Apache Software Foundation Apache Johnzon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages](https://agentprime.io/advisories/CVE-2026-83531.md)
  `CVE-2026-83531` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers](https://agentprime.io/advisories/CVE-2026-78164.md)
  `CVE-2026-78164` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Code injection
- [AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection](https://agentprime.io/advisories/CVE-2026-112102.md)
  `CVE-2026-112102` · CVE record: AXA Group NLP.js · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.\_\_init\_\_ code injection](https://agentprime.io/advisories/CVE-2026-112100.md)
  `CVE-2026-112100` · CVE record: DeepPavlov · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-110887.md)
  `CVE-2026-110887` · CVE record: HivePress HivePress · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [DeepPavlov Config Reference Resolver params.py resolve code injection](https://agentprime.io/advisories/CVE-2026-112098.md)
  `CVE-2026-112098` · CVE record: DeepPavlov · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting](https://agentprime.io/advisories/CVE-2026-112097.md)
  `CVE-2026-112097` · CVE record: SourceCodester Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting](https://agentprime.io/advisories/CVE-2026-112096.md)
  `CVE-2026-112096` · CVE record: SourceCodester Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Inventory System Product Management products_handler.php save cross site scripting](https://agentprime.io/advisories/CVE-2026-112095.md)
  `CVE-2026-112095` · CVE record: SourceCodester Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [subhajitkhan online-clinic-management-system feedback.php cross site scripting](https://agentprime.io/advisories/CVE-2026-112093.md)
  `CVE-2026-112093` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting](https://agentprime.io/advisories/CVE-2026-112092.md)
  `CVE-2026-112092` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-108121.md)
  `CVE-2026-108121` · CVE record: Koozali SME Server · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection, Denial of service, CWE-20
- [LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection](https://agentprime.io/advisories/CVE-2026-112080.md)
  `CVE-2026-112080` · CVE record: LlamaChinese Llama-Chinese · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info\_ code injection](https://agentprime.io/advisories/CVE-2026-112078.md)
  `CVE-2026-112078` · CVE record: RVC-Project Retrieval-based-Voice-Conversion-WebUI · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [JDBC LogFactory 任意类加载/构造导致潜在 RCE](https://agentprime.io/advisories/CVE-2026-111440.md)
  `CVE-2026-111440` · CVE record: openGauss-server openGauss-connector-jdbc · CVSS 7.0 High · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code](https://agentprime.io/advisories/CVE-2026-112075.md)
  `CVE-2026-112075` · CVE record: unslothai unsloth · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting](https://agentprime.io/advisories/CVE-2026-112042.md)
  `CVE-2026-112042` · CVE record: diem-project diem · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [diem-project diem Administrative Console actions.class.php append cross site scripting](https://agentprime.io/advisories/CVE-2026-112039.md)
  `CVE-2026-112039` · CVE record: diem-project diem · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting](https://agentprime.io/advisories/CVE-2026-112038.md)
  `CVE-2026-112038` · CVE record: diem-project diem · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Chamilo LMS Ticket TicketManager.php addProject cross site scripting](https://agentprime.io/advisories/CVE-2026-112031.md)
  `CVE-2026-112031` · CVE record: Chamilo LMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.\_\_init\_\_ code injection](https://agentprime.io/advisories/CVE-2026-111991.md)
  `CVE-2026-111991` · CVE record: WongKinYiu yolov9 · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, Code injection
- [AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting](https://agentprime.io/advisories/CVE-2026-111987.md)
  `CVE-2026-111987` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection](https://agentprime.io/advisories/CVE-2026-111986.md)
  `CVE-2026-111986` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Other injection, Code injection
- [AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting](https://agentprime.io/advisories/CVE-2026-111984.md)
  `CVE-2026-111984` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval](https://agentprime.io/advisories/CVE-2026-78497.md)
  `CVE-2026-78497` · CVE record · CVSS 8.4 High · Not analysed yet · Published 18 Oct 2026 · Tags: Code injection
- [WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-110885.md)
  `CVE-2026-110885` · CVE record: HivePress HivePress · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Code injection
- [hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting](https://agentprime.io/advisories/CVE-2026-111942.md)
  `CVE-2026-111942` · CVE record: hrisikeshpal Blood_Bank_Management_System · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [dext34-morgan Books4Cash search.php cross site scripting](https://agentprime.io/advisories/CVE-2026-111877.md)
  `CVE-2026-111877` · CVE record: dext34-morgan Books4Cash · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection](https://agentprime.io/advisories/CVE-2026-111865.md)
  `CVE-2026-111865` · CVE record: THU-MIG yoloe · CVSS 4.8 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Code injection
- [User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag](https://agentprime.io/advisories/CVE-2026-92798.md)
  `CVE-2026-92798` · CVE record: wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 8.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Code injection
- [WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint](https://agentprime.io/advisories/CVE-2026-111687.md)
  `CVE-2026-111687` · CVE record: rachelos we-mp-rss · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [TuxGuitar: Arbitrary Code Execution via maliciously crafted \`.tg\` file](https://agentprime.io/advisories/CVE-2026-55543.md)
  `CVE-2026-55543` · CVE record: helge17 tuxguitar · CVSS 8.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Apache Kylin: JDBC URL Whitelist Verification Bypass](https://agentprime.io/advisories/CVE-2026-68571.md)
  `CVE-2026-68571` · CVE record: Apache Software Foundation Apache Kylin · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter](https://agentprime.io/advisories/CVE-2026-111391.md)
  `CVE-2026-111391` · CVE record: sgl-project sglang · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Render…](https://agentprime.io/advisories/CVE-2026-104003.md)
  `CVE-2026-104003` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-94169.md)
  `CVE-2026-94169` · CVE record: Theme-one The Grid · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name](https://agentprime.io/advisories/CVE-2026-15222.md)
  `CVE-2026-15222` · CVE record: wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta](https://agentprime.io/advisories/CVE-2026-104001.md)
  `CVE-2026-104001` · CVE record: rilwis Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block](https://agentprime.io/advisories/CVE-2026-103911.md)
  `CVE-2026-103911` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags](https://agentprime.io/advisories/CVE-2026-101335.md)
  `CVE-2026-101335` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback](https://agentprime.io/advisories/CVE-2026-96562.md)
  `CVE-2026-96562` · CVE record: wpmudev Broken Link Checker · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTEwLTE2VDA0OjI2OjU4LjE1NzAwMFoiLCJDVkUtMjAyNi05NjU2MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTEwLTIxVDE2OjE3OjQ0LjY1NzAwMFoiLCJDVkUtMjAyNi03NjQ5NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTEwLTIxVDE2OjE3OjQ0LjY1NzAwMFoiLCJDVkUtMjAyNi03NjQ5NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.