CWE-184.

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

• ag2
• ag2ai autogen
• Command injection
• CWE-184

Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

• sensiolabs symfony
• CWE-184
• CWE-1023

Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

• sensiolabs symfony
• Server-side request forgery (SSRF)
• CWE-184

CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

• CWE-184
• CWE-436

>=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

• CWE-184
• CWE-436

>=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

• vsftpd
• CWE-184

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

• Command injection
• CWE-184

<4.6.78 · fixed in 4.6.78

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

• Microsoft Edge (Chromium-based)
• CWE-184

Hydra legacy target blacklist permits unsafe PyYAML loading

• CWE-184

>=1.3.6, <1.3.8 || >=1.4.0.dev9, <1.4.0rc3 · fixed in 1.3.8, 1.4.0rc3

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

• Weak cryptography or TLS
• CWE-184

>=1.3.1, <1.9.0 · fixed in 1.9.0

JetBrains Junie CLI: In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete…

• JetBrains Junie CLI
• CWE-184

iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

• iFlytek astron-agent
• CWE-183
• CWE-184

Incomplete validation in the run_script Python sandbox in AWS MCP Server

• AWS MCP Server
• CWE-184

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

• agentfront mcp-from-openapi
• CWE-184

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content…

• Roundcube Webmail
• CWE-184

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content…

• Roundcube Webmail
• CWE-184

Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

• Stirling-Tools Stirling-PDF
• CWE-184

Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

• cms
• CWE-184

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

• CWE-20
• CWE-184

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

• Lychee
• CWE-20
• CWE-184

Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation

• PeaZip
• CWE-184
• CWE-693

Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-184

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2019
• CWE-184

Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution

• RooCodeInc Roo-Code
• CWE-184

GNU Emacs: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a…

• GNU Emacs
• CWE-184

OS command injection in Amazon Agent Plugins for AWS databases-on-aws

• databases-on-aws
• CWE-184

Handlebars: JavaScript Injection via Own Property Check Bypass

• CWE-184
• CWE-1289

>=3.0.0, <4.7.10 · fixed in 4.7.10

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

• Server-side request forgery (SSRF)
• CWE-184

>=6.0.9, <6.65.0 · fixed in 6.65.0

Ghost: Stored XSS via oEmbed Photo Responses

• Cross-site scripting (XSS)
• CWE-184

>=2.5.0, <6.64.0 · fixed in 6.64.0

Hydra instantiate target blacklist bypasses permit code execution

• CWE-184

>=1.3.4, <1.3.6 || >=1.4.0.dev0, <1.4.0.dev9 · fixed in 1.3.6, 1.4.0.dev9

Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

• backstage
• @backstage plugin-techdocs-node
• Command injection
• CWE-184

JetBrains TeamCity: In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE…

• JetBrains TeamCity
• CWE-184

Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

• microsoft UFO
• Command injection
• CWE-184

Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

• microsoft UFO
• Command injection
• CWE-184

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

• Command injection
• CWE-184

<2.0.1 · fixed in 2.0.1

simple-git unsafe-operation guard does not block trailer command configuration

• Command injection
• CWE-184

>=3.15.0, <4.0.1 · fixed in 4.0.1

rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

• rhukster dom-sanitizer
• CWE-183
• CWE-184

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

• OpenClaw Windows Node
• CWE-184

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set

• OpenClaw Windows Node
• CWE-184

JetBrains TeamCity: In JetBrains TeamCity before 2026.2, 2026.1.4…

• JetBrains TeamCity
• CWE-184

SSRF via DNS-resolution gap in _validate_url_security (file download by URL)

• leshchenko1979 fast-mcp-telegram
• Server-side request forgery (SSRF)
• CWE-184

Zammad: Remote image tracking bypass via shortened URL scheme

• zammad
• CWE-20
• CWE-184

@bytebase/dbhub's read-only mode does not prevent database writes

• Broken access control
• CWE-184

<0.22.6 · fixed in 0.22.6

OpenStack Swift: In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From…

• OpenStack Swift
• CWE-184

Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-co…

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-184

Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution i…

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-184

Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• CWE-184

MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

• Broken access control
• CWE-184

<0.22.0 · fixed in 0.22.0

openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

• Apereo Foundation openEQUELLA
• Insecure deserialization
• CWE-184

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

• chartbrew
• CWE-184

ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

• ArcadeData arcadedb
• CWE-184

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

• Cross-site scripting (XSS)
• CWE-184

<0.22.1 · fixed in 0.22.1

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

• Cross-site scripting (XSS)
• Code injection

>=2.0.0, <2.0.1 · fixed in 2.0.1

IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

• IBM ContextForge MCP Gateway
• CWE-184

HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist

• HKUDS nanobot
• CWE-183
• CWE-184

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments.

• mistralai mistral-vibe
• CWE-184

Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

• AWS Labs postgres MCP Server
• Command injection
• CWE-184

Incomplete list of disallowed inputs in awslabs mysql-mcp-server

• AWS Labs MySQL MCP Server
• CWE-184

PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

• pmmp PocketMine-MP
• CWE-184

Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

• Google Cloud Agent Development Kit (ADK) for Python
• CWE-184