# CWE-150.

Every Advisory and CVE whose sources give the weakness CWE-150, newest first.

## Records, newest first (an older page)

- [Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences](https://agentprime.io/advisories/GHSA-vfww-5hm6-hx2j.md)
  `GHSA-vfww-5hm6-hx2j`, `BIT-tomcat-2025-55754`, `CVE-2025-55754` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.11 || >=10.1.0-M1, <10.1.45 || >=9.0.40, <9.0.109 || >=8.5.60, <=8.5.100`, fixed in `11.0.11`, `10.1.45`, `9.0.109` · CVSS 9.6 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-150
- [Logging user input may result in poisoning logs with ANSI escape sequences](https://agentprime.io/advisories/GHSA-xwfj-jgwm-7wp5.md)
  `GHSA-xwfj-jgwm-7wp5`, `CVE-2025-58160`, `RUSTSEC-2025-0055` · crates.io `tracing-subscriber`: affected `>=0.0.0-0, <0.3.20`, fixed in `0.3.20` · CVSS 2.3 Low · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-150
- [Active Record logging vulnerable to ANSI escape injection](https://agentprime.io/advisories/GHSA-76r7-hhxj-r776.md)
  `GHSA-76r7-hhxj-r776`, `CVE-2025-55193` · RubyGems `activerecord`: affected `<7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1`, fixed in `7.1.5.2`, `7.2.2.2`, `8.0.2.1` · CVSS 2.7 Low · Not analysed yet · Published 13 Aug 2025 · Tags: CWE-150
- [Apache HTTP Server: mod_ssl error log variable escaping](https://agentprime.io/advisories/CVE-2024-47252.md)
  `CVE-2024-47252` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-150
- [Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener](https://agentprime.io/advisories/GHSA-9x73-87fh-54w9.md)
  `GHSA-9x73-87fh-54w9`, `CVE-2025-47284`, `GO-2025-3698` · Go `github.com/gardener/gardener`: affected `<1.116.4 || >=1.117.0, <1.117.5 || >=1.118.0, <1.118.2`, fixed in `1.116.4`, `1.117.5`, `1.118.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2025 · Tags: CWE-150
- [Apache Tomcat Rewrite rule bypass](https://agentprime.io/advisories/GHSA-ff77-26x5-69cr.md)
  `GHSA-ff77-26x5-69cr`, `BIT-tomcat-2025-31651`, `CVE-2025-31651` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100`, fixed in `9.0.104`, `10.1.40`, `11.0.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-116, CWE-150
- [BusyBox: In netstat in BusyBox through 1.37.0…](https://agentprime.io/advisories/CVE-2024-58251.md)
  `CVE-2024-58251` · CVE record: BusyBox BusyBox · CVSS 2.5 Low · Not analysed yet · Published 23 Apr 2025 · Tags: CWE-150
- [gurk (aka gurk-rs) mishandles ANSI escape sequences](https://agentprime.io/advisories/GHSA-89xp-c3mq-qj84.md)
  `GHSA-89xp-c3mq-qj84`, `CVE-2025-30089` · crates.io `gurk`: affected `<=0.6.3`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-150
- [IBM MQ code execution](https://agentprime.io/advisories/CVE-2025-0975.md)
  `CVE-2025-0975` · CVE record: IBM MQ · CVSS 8.8 High · Not analysed yet · Published 28 Feb 2025 · Tags: CWE-150
- [MongoDB Shell may be susceptible to control character Injection via shell output](https://agentprime.io/advisories/GHSA-r95j-4jvf-mrrw.md)
  `GHSA-r95j-4jvf-mrrw`, `CVE-2025-1693` · npm `mongosh`: affected `<2.3.9`, fixed in `2.3.9` · CVSS 3.9 Low · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-150
- [MongoDB Shell may be susceptible to control character injection via pasting](https://agentprime.io/advisories/GHSA-973h-3x6p-qg37.md)
  `GHSA-973h-3x6p-qg37`, `CVE-2025-1692` · npm `mongosh`: affected `<2.3.9`, fixed in `2.3.9` · CVSS 6.3 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-150
- [Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header](https://agentprime.io/advisories/GHSA-c2p2-hgjg-9r3f.md)
  `GHSA-c2p2-hgjg-9r3f`, `PKSA-96gb-zv83-hqq7` · Packagist `islandora/crayfish`: affected `<=4.0.0`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 12 Feb 2025 · Tags: Other injection, CWE-150
- [Crayfish allows Remote Code Execution via Homarus Authorization header](https://agentprime.io/advisories/GHSA-mm6v-68qp-f9fw.md)
  `GHSA-mm6v-68qp-f9fw`, `CVE-2025-25286`, `PKSA-y8f8-ggcf-nysv` · Packagist `islandora/crayfish`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-150, CWE-157
- [The sideband payload is passed unfiltered to the terminal in git](https://agentprime.io/advisories/CVE-2024-52005.md)
  `CVE-2024-52005` · CVE record: git git · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-116, CWE-150
- [Git does not sanitize URLs when asking for credentials interactively](https://agentprime.io/advisories/CVE-2024-50349.md)
  `CVE-2024-50349` · CVE record: git git · CVSS 2.1 Low · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-116, CWE-147, CWE-150
- [Newline confusion in credential helpers can lead to credential exfiltration in git](https://agentprime.io/advisories/CVE-2024-52006.md)
  `CVE-2024-52006` · CVE record: git git · CVSS 2.1 Low · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-116, CWE-147, CWE-150
- [jte's HTML templates containing Javascript template strings are subject to XSS](https://agentprime.io/advisories/GHSA-vh22-6c6h-rm8q.md)
  `GHSA-vh22-6c6h-rm8q`, `CVE-2025-23026` · Maven `gg.jte:jte` and 1 more: affected `<3.1.16`, fixed in `3.1.16` · CVSS 6.1 Medium · Not analysed yet · Published 13 Jan 2025 · Tags: Cross-site scripting (XSS), CWE-150
- [python-sql SQL injection vulnerability](https://agentprime.io/advisories/GHSA-pq9p-pc3p-9hm4.md)
  `GHSA-pq9p-pc3p-9hm4`, `CVE-2024-9774`, `PYSEC-2026-1855` · PyPI `python-sql`: affected `<1.5.2`, fixed in `1.5.2` · CVSS 6.5 Medium · Not analysed yet · Published 27 Dec 2024 · Tags: CWE-150
- [Jinja has a sandbox breakout through malicious filenames](https://agentprime.io/advisories/GHSA-gmj6-6f8f-6699.md)
  `GHSA-gmj6-6f8f-6699`, `CVE-2024-56201`, `PYSEC-2026-1472` · PyPI `jinja2`: affected `>=3.0.0, <3.1.5`, fixed in `3.1.5` · CVSS 5.4 Medium · Not analysed yet · Published 23 Dec 2024 · Tags: CWE-150
- [gitoxide-core does not neutralize special characters for terminals](https://agentprime.io/advisories/GHSA-88g2-r9rw-g55h.md)
  `GHSA-88g2-r9rw-g55h`, `CVE-2024-43785`, `RUSTSEC-2024-0364` · crates.io `gitoxide-core`: affected `>=0.0.0-0`, no fixed version yet · CVSS 2.5 Low · Not analysed yet · Published 22 Aug 2024 · Tags: CWE-150
- [Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen](https://agentprime.io/advisories/GHSA-jmp2-wc4p-wfh2.md)
  `GHSA-jmp2-wc4p-wfh2`, `CVE-2023-30844`, `GO-2023-1764` · Go `github.com/mutagen-io/mutagen` and 1 more: affected `<0.16.6 || >=0.17.0, <0.17.1`, fixed in `0.16.6`, `0.17.1` · CVSS 3.0 Low · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-150
- [RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.](https://agentprime.io/advisories/CVE-2024-36052.md)
  `CVE-2024-36052` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 May 2024 · Tags: CWE-150
- [Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox](https://agentprime.io/advisories/CVE-2024-32986.md)
  `CVE-2024-32986` · CVE record: filips123 PWAsForFirefox · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 May 2024 · Tags: Other injection, CWE-150
- [RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.](https://agentprime.io/advisories/CVE-2024-33899.md)
  `CVE-2024-33899` · CVE record · CVSS 7.1 High · Not analysed yet · Published 28 Apr 2024 · Tags: CWE-150
- [wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv.](https://agentprime.io/advisories/CVE-2024-28085.md)
  `CVE-2024-28085` · CVE record · CVSS 3.3 Low · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-150
- [Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping](https://agentprime.io/advisories/GHSA-m4pq-fv2w-6hrw.md)
  `GHSA-m4pq-fv2w-6hrw`, `CVE-2024-27936` · crates.io `deno` and 1 more: affected `>=1.32.1, <1.41.0`, fixed in `1.41.0` · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2024 · Tags: CWE-150
- [Shescape on Windows escaping may be bypassed in threaded context](https://agentprime.io/advisories/GHSA-j55r-787p-m549.md)
  `GHSA-j55r-787p-m549`, `CVE-2023-40185` · npm `shescape`: affected `<1.7.4`, fixed in `1.7.4` · CVSS 6.5 Medium · Not analysed yet · Published 22 Aug 2023 · Tags: CWE-150
- [CyberPower PowerPanel Enterprise: An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to…](https://agentprime.io/advisories/CVE-2023-3265.md)
  `CVE-2023-3265` · CVE record: CyberPower PowerPanel Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2023 · Tags: CWE-150
- [Dangerzone CLI does not sanitize ANSI escape characters](https://agentprime.io/advisories/CVE-2023-39342.md)
  `CVE-2023-39342` · CVE record: freedomofpress dangerzone · CVSS 3.6 Low · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-150
- [Interactive \`run\` permission prompt spoofing via improper ANSI neutralization](https://agentprime.io/advisories/GHSA-vq67-rp93-65qf.md)
  `GHSA-vq67-rp93-65qf`, `CVE-2023-28446` · crates.io `deno` and 1 more: affected `>=1.8.0, <1.31.2`, fixed in `1.31.2` · CVSS 8.8 High · Not analysed yet · Published 24 Mar 2023 · Tags: CWE-150
- [XWiki Platform may allow privilege escalation to programming rights via user's first name](https://agentprime.io/advisories/GHSA-8cw6-4r32-6r3h.md)
  `GHSA-8cw6-4r32-6r3h`, `CVE-2023-26055` · Maven `org.xwiki.commons:xwiki-commons-xml`: affected `>=3.1-milestone-1, <13.10.9 || >=14.0-rc-1, <14.4.4 || >=14.5, <14.7-rc-1`, fixed in `13.10.9`, `14.4.4`, `14.7-rc-1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2023 · Tags: CWE-150
- [Possible shell escape sequence injection vulnerability in Rack](https://agentprime.io/advisories/GHSA-wq4h-7r42-5hrr.md)
  `GHSA-wq4h-7r42-5hrr`, `CVE-2022-30123` · RubyGems `rack`: affected `<2.0.9.1 || >=2.1, <2.1.4.1 || >=2.2, <2.2.3.1`, fixed in `2.0.9.1`, `2.1.4.1`, `2.2.3.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2022 · Tags: CWE-150
- [RubyGems Code Injection vulnerability](https://agentprime.io/advisories/GHSA-7gcp-2gmq-w3xh.md)
  `GHSA-7gcp-2gmq-w3xh`, `CVE-2017-0899` · RubyGems `rubygems-update`: affected `<2.6.13`, fixed in `2.6.13` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 13 May 2022 · Tags: Code injection, CWE-150
- [kubectl ANSI escape characters not filtered](https://agentprime.io/advisories/GHSA-f9jg-8p32-2f55.md)
  `GHSA-f9jg-8p32-2f55`, `CVE-2021-25743`, `GO-2022-0983` · Go `k8s.io/kubernetes`: affected `<1.26.0-alpha.3`, fixed in `1.26.0-alpha.3` · CVSS 3.0 Low · Not analysed yet · Published 8 Jan 2022 · Tags: CWE-150
- [Control character injection in console output in github.com/ipfs/go-ipfs](https://agentprime.io/advisories/GHSA-r4gv-vj59-cccm.md)
  `GHSA-r4gv-vj59-cccm`, `CVE-2020-26283`, `GO-2022-0873` · Go `github.com/ipfs/go-ipfs`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 6.8 Medium · Not analysed yet · Published 23 Jun 2021 · Tags: CWE-116, CWE-150
- [The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacte…](https://agentprime.io/advisories/CVE-2021-25310.md)
  `CVE-2021-25310` · CVE record · No CVSS score · Not analysed yet · Published 2 Feb 2021 · Tags: CWE-150
- [An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to pote…](https://agentprime.io/advisories/CVE-2020-6932.md)
  `CVE-2020-6932` · CVE record: BlackBerry QNX Software Development Platform (SDP) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2020 · Tags: CWE-150

Newest: <https://agentprime.io/advisories/tag/cwe-150.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-150&cursor=WyIyMDI1LTExLTE3VDE5OjExOjIzLjAwMDAwMFoiLCJHSFNBLWZ2MnItcjhtcC1wZzQ4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-150/?cursor=WyIyMDI1LTExLTE3VDE5OjExOjIzLjAwMDAwMFoiLCJHSFNBLWZ2MnItcjhtcC1wZzQ4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.