Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting
- welovemedia FFmate
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting
- bufanyun HotGo
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
z-9527 admin Message Create Endpoint message.js cross site scripting
- z-9527 admin
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
gougucms Record Endpoint record.html cross site scripting
- gougucms
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
XenForo Remote Code Execution via Authenticated Admin
- XenForo
- Code injection
- CVSS 8.7 High
XenForo Template Method Call Restriction Bypass
- XenForo
- Code injection
- CVSS 8.6 High
SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution
- Cross-site scripting (XSS)
- Code injection
<0.0.0-20260329142331-918d1bd9f967 · fixed in 0.0.0-20260329142331-918d1bd9f967
GHSA-ff66-236v-p4fg · CVE-2026-34585 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP…
- Code injection
- CVSS 5.3 Medium
code-projects BloodBank Managing System admin_state.php cross site scripting
- code-projects BloodBank Managing System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client
- Cross-site scripting (XSS)
- Code injection
<3.6.2 · fixed in 3.6.2
GHSA-rx4h-526q-4458 · CVE-2026-34448 - CVSS 4.8 Medium
SourceCodester Leave Application System User Management cross site scripting
- SourceCodester Leave Application System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
- WPEverest Everest Forms Pro
- Code injection
- CVSS 5.3 Medium
code-projects Online Food Ordering System Order order.php cross site scripting
- code-projects Online Food Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
- supsysticcom Contact Form by Supsystic
- Code injection
- CVSS 8.8 High
OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution
- OpenOLAT
- Code injection
- CVSS 7.5 High
Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
- Tautulli
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
OS command injection in Vim
- Vim
- Command injection
- Code injection
- CVSS 4.8 Medium
code-projects Exam Form Submission update_fst.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Syntx's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization
- CASIANO GRID::Machine
- Code injection
- Insecure deserialization
- CVSS 5.3 Medium
elecV2 elecV2P Endpoint logs cross site scripting
- elecV2P
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
elecV2 elecV2P JSON webhook runJSFile code injection
- elecV2P
- Other injection
- Code injection
- CVSS 6.9 Medium
Sinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injection
- Sinaptik AI PandasAI
- Other injection
- Code injection
- CVSS 5.1 Medium
wandb OpenUI Window Message Event index.html cross site scripting
- wandb OpenUI
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Zebra node crash — V5 transaction hash panic (P2P reachable)
- Code injection
<6.0.1 · fixed in 6.0.1
GHSA-qp6f-w4r3-h8wg · CVE-2026-34202 - CVSS 7.7 High
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
- Code injection
<0.3.4 || >=1.0.1a1, <1.0.2b1 · fixed in 0.3.4, 1.0.2b1
GHSA-frv4-x25r-588m · CVE-2026-34172 - CVSS 5.3 Medium
wandb OpenUI HTMLAnnotator server.py get_share HTML injection
- wandb OpenUI
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting
- QDOCS Smart School Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
Notesnook vulnerable to RCE via stored XSS in Note History diff viewer
- streetwriters Notesnook Web/Desktop
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering
- streetwriters Notesnook Web/Desktop
- streetwriters Notesnook iOS/Android
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.3 High
Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor
- windmill
- Code injection
- CVSS 5.1 Medium
SourceCodester Online Quiz System add-question.php cross site scripting
- SourceCodester Online Quiz System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.9 High
Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
- HKUDS nanobot
- Code injection
- Authentication bypass
- CVSS 7.1 High
Ruby LSP has arbitrary code execution through branch setting
- Code injection
<0.26.9 · fixed in 0.26.9
GHSA-c4r5-fxqw-vh93 · CVE-2026-34060 - CVSS 4.8 Medium
code-projects Online Reviewer System btn_functions.php cross site scripting
- code-projects Online Reviewer System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Hugging Face Smolagents has an Injection issue
- Other injection
- Code injection
<=1.25.0.dev0 · no fixed version yet
GHSA-54fq-v6x8-244g · CVE-2026-4963 - CVSS 5.1 Medium
code-projects Social Networking Site Alert home.php cross site scripting
- code-projects Social Networking Site
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.3 High
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- Cross-site scripting (XSS)
- Code injection
>=4.0.0, <4.7.9 · fixed in 4.7.9
GHSA-xjpj-3mr7-gcpf · CVE-2026-33941 - CVSS 8.1 High
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- Code injection
- Memory corruption
>=4.0.0, <4.7.9 · fixed in 4.7.9
GHSA-xhpv-hc6g-r9c6 · CVE-2026-33940 - CVSS 8.1 High
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- Code injection
- Memory corruption
>=4.0.0, <4.7.9 · fixed in 4.7.9
GHSA-3mfm-83xf-c92r · CVE-2026-33938 - CVSS 9.8 CriticalCritical · CVSS 9+
Handlebars.js has JavaScript Injection via AST Type Confusion
- Code injection
- Memory corruption
>=4.0.0, <4.7.9 · fixed in 4.7.9
GHSA-2w6w-674q-4c4q · CVE-2026-33937 - CVSS 6.3 Medium
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
- Other injection
- Code injection
<=2.11.42 · no fixed version yet
GHSA-67jx-r9pv-98rj · CVE-2026-32695 - CVSS 6.9 Medium
letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection
- letta
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Incus vulnerable to arbitrary file read and write through pongo templates
- Code injection
<=0.7.0 · no fixed version yet
GHSA-83xr-5xxr-mh92 · CVE-2026-33897 - CVSS 7.1 High
Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
- wazuh-agent
- wazuh-manager
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
RCE on Grafana via sqlExpressions
- Grafana
- SQL injection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
- Command injection
- Code injection
>=1.0.0, <1.0.5 || >=1.1.0-M1, <1.1.4 · fixed in 1.0.5, 1.1.4
GHSA-fvh3-672c-7p6c · CVE-2026-22738 - CVSS 8.7 High
Code injection in BUFFALO INC. BUFFALO Wi-Fi router products
- BUFFALO INC. BUFFALO Wi-Fi router products
- Code injection
- CVSS 4.8 Medium
code-projects Exam Form Submission update_s7.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
- Code injection
>=15.10.0, <20.8.8 · fixed in 20.8.8
GHSA-6q6h-j7hj-3r64 · CVE-2026-33943 - CVSS 4.8 Medium
code-projects Online Food Ordering System food.php cross site scripting
- code-projects Online Food Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Online Food Ordering System contact.php cross site scripting
- code-projects Online Food Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.4 High
Contrast BadAML injection allows arbitrary code execution
- Code injection
<1.18.0 · fixed in 1.18.0
GHSA-g9ww-x58f-9g6m · CVE-2026-100839 - CVSS 9.3 CriticalCritical · CVSS 9+
Langflow has Authenticated Code Execution in Agentic Assistant Validation
- Code injection
<1.9.0 · fixed in 1.9.0
GHSA-v8hw-mh8c-jxfc · CVE-2026-33873 - CVSS 5.3 Medium
itsourcecode Payroll Management System index.php cross site scripting
- itsourcecode Payroll Management System
- Cross-site scripting (XSS)
- Code injection