CWE-184.

SVGO: removeScripts allows executable links through namespace and control-character bypasses

• Cross-site scripting (XSS)
• CWE-184

>=1.0.0, <2.8.4 || >=3.0.0, <3.3.5 || >=4.0.0, <4.1.0 · fixed in 2.8.4, 3.3.5, 4.1.0

Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator

• RooCodeInc Roo-Code
• CWE-184

Active Directory Certificate Services (AD CS) Tampering Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-184

Visual Studio Code Security Feature Bypass Vulnerability

• Microsoft Visual Studio Code
• CWE-184

BDS Module Bypass Secure Boot Advisory

• AMI AptioV
• CWE-184

An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

• Amazon postgres-mcp-server
• CWE-184

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

• Cross-site scripting (XSS)
• CWE-184

<9.4.3 · fixed in 9.4.3

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

• CWE-184

<0.3.0 · fixed in 0.3.0

Nexus Repository 3 - Script Execution Disable Setting Not Enforced

• Sonatype Nexus Repository 3
• CWE-184

jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input

• CWE-184

<2.6.2 · fixed in 2.6.2

RestrictedPython guard hooks can be shadowed via positional-only arguments

• CWE-184

<8.3 · fixed in 8.3

An input reflection vulnerability affects HCL Traveler

• HCLSoftware Traveler
• CWE-20
• CWE-184

NVIDIA OpenShell: NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API…

• NVIDIA OpenShell
• CWE-184

Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode

• continue
• CWE-184

Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

• Limit Login Attempts Security
• CWE-184

9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

• decolua 9router
• Server-side request forgery (SSRF)
• CWE-184

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Atta...

• CWE-184

<1.4.0 · fixed in 1.4.0

Flowise before 3.1.3 Sandbox Escape via Pandas Methods

• Flowise
• CWE-184

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

• Server-side request forgery (SSRF)
• CWE-184

<4.1.0 · fixed in 4.1.0

Fortinet FortiWeb: A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through…

• Fortinet FortiWeb
• Fortinet FortiOS
• CWE-184

Vim: Arbitrary Code Execution via Netrw Menu Construction

• vim
• Command injection
• CWE-184

Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

• CWE-184

>=4.0.0-RC1 · no fixed version yet

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

• CWE-184

>=4.0.0-RC1, <4.18.2 || >=5.0.0-RC1, <5.10.6 · fixed in 4.18.2, 5.10.6

Langflow is affected by security vulnerabilities in Model Context Protocol features

• IBM Langflow OSS
• CWE-184

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

• esphome
• CWE-184

Ghost: Private IP filtering bypass to make server-side requests to internal services

• Server-side request forgery (SSRF)
• CWE-184

>=6.0.9, <6.21.1 · fixed in 6.21.1

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

• CWE-184

<3.1.3 · fixed in 3.1.3

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

• CWE-184

<3.1.3 · fixed in 3.1.3

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

• @fastify/forwarded
• CWE-20
• CWE-184

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

• Information disclosure
• CWE-184

<2.0.62 || >=2.1.0-alpha.1, <2.1.0-alpha.46 || >=2.1.0-beta.1, <2.1.0-beta.45 · fixed in 2.0.62, 2.1.0-alpha.46, 2.1.0-beta.45

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

• Command injection
• CWE-184

<3.1.54 · fixed in 3.1.54

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

• NLnet Labs Unbound
• CWE-184

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

• Cross-site scripting (XSS)
• CWE-184

>=2.25.0, <2.25.2 · fixed in 2.25.2

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

• Command injection
• CWE-184

<3.1.51 · fixed in 3.1.51

SVGO removeScripts plugin leaves some executable scripts intact

• Cross-site scripting (XSS)
• CWE-184

>=1.0.0, <2.8.3 || >=3.0.0, <3.3.4 || >=4.0.0, <4.0.2 · fixed in 2.8.3, 3.3.4, 4.0.2

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

• Cross-site scripting (XSS)
• CWE-184

<3.4.12 · fixed in 3.4.12

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

• CWE-184

>=2.25.0, <2.25.2 · fixed in 2.25.2

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

• Cross-site scripting (XSS)
• CWE-184

<3.3.0 · fixed in 3.3.0

Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing

• RooCodeInc Roo-Code
• CWE-184

princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

• princezuda SafestClaw
• CWE-183
• CWE-184

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

• IBM Langflow OSS
• CWE-184

OpenClaw < 2026.6.6 Environment Variable Injection via rustup

• OpenClaw
• CWE-184

nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist

• nextlevelbuilder GoClaw
• CWE-183
• CWE-184

OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport

• OpenClaw
• CWE-184

OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering

• OpenClaw
• CWE-184

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

• Cross-site scripting (XSS)
• CWE-184

<0.0.0-20260628153353-2d5d72223df4 · fixed in 0.0.0-20260628153353-2d5d72223df4

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

• Cross-site scripting (XSS)
• CWE-184

<0.4.5 · fixed in 0.4.5

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files

• OpenClaw
• CWE-184

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because ...

• Insecure deserialization
• CWE-184

<0.1.11 · fixed in 0.1.11

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

• CWE-184

<2026.5.12 · fixed in 2026.5.12

PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

• CWE-184
• CWE-693

<4.6.40 · fixed in 4.6.40

PickleScan's profile.run blocklist mismatch allows exec() bypass

• CWE-184

<1.0.4 · fixed in 1.0.4

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

• kestra
• Command injection
• Authentication bypass

Mastodon: SSRF protection bypass on older Ruby versions

• mastodon
• Information disclosure
• Server-side request forgery (SSRF)

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

• CWE-184

>=2.10.0, <2.18.8 || >=2.19.0, <2.21.4 || >=3.0.0, <3.1.4 · fixed in 2.18.8, 2.21.4, 3.1.4

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

• Insecure deserialization
• CWE-184

>=2.10.0, <2.18.8 || >=3.0.0, <3.1.4 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 3.1.4, 2.21.4

Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist

• CWE-184

<1.0.4 · fixed in 1.0.4

Duplicate Advisory: Picklescan missing detection when calling built-in python library function timeit.timeit()

• CWE-184

<0.0.25 · fixed in 0.0.25

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

• XML external entities (XXE)
• CWE-178

<1.19.4 · fixed in 1.19.4

OpenClaw: Shell positional parameters could weaken strict inline-eval checks

• Command injection
• Privilege escalation

<2026.4.2 · fixed in 2026.4.2