Advisories · Weakness

CWE-693.

Every Advisory and CVE whose sources give the weakness CWE-693, newest first.

praisonai npm

CVSS 8.8 High

npm PraisonAI AgentLoop onToolCall approval runs after tool execution
- Broken access control
- CWE-693
>=1.4.0, <1.7.2 · fixed in 1.7.2

GHSA-h2w2-v7j6-xqm4 · CVE-2026-57137 Not analysed yet 18 Jun 2026
praisonai npm

CVSS 8.8 High

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
- Command injection
- Broken access control
>=1.2.3, <1.7.2 · fixed in 1.7.2

GHSA-vjv9-7m7j-h833 · CVE-2026-57136 Not analysed yet 18 Jun 2026
praisonai npm

CVSS 9.9 CriticalCritical · CVSS 9+

npm PraisonAI codeMode sandbox escape via Function constructor
- CWE-184
- CWE-693
>=1.4.0, <1.7.2 · fixed in 1.7.2

GHSA-vmmj-pfw7-fjwp · CVE-2026-57138 Not analysed yet 18 Jun 2026
praisonai npm

CVSS 7.6 High

npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
- CWE-653
- CWE-693
>=1.2.3, <1.7.2 · fixed in 1.7.2

GHSA-gqmf-56h7-rrpf · CVE-2026-57135 Not analysed yet 18 Jun 2026
praisonaiagents PyPI

CVSS 6.5 Medium

PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
- CWE-693
<1.6.59 · fixed in 1.6.59

GHSA-pv2j-rghr-v5r9 · CVE-2026-57120 Not analysed yet 18 Jun 2026
praisonai PyPI

CVSS 7.8 High

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
- Command injection
- Broken access control
>=4.5.87, <4.6.59 · fixed in 4.6.59

GHSA-v847-hxxw-3pxg · CVE-2026-56838 Not analysed yet 18 Jun 2026
picklescan PyPI

CVSS 8.8 High

Duplicate Advisory: Picklescan Bypasses Unsafe Globals Check using pty.spawn
- CWE-693
* · no fixed version yet

GHSA-5gp7-4733-2w2v Withdrawn Not analysed yet 17 Jun 2026
open-webui PyPI

CVSS 7.6 High

Open WebUI: Stored XSS to Account Takeover via Model Profile Images
- Cross-site scripting (XSS)
- CWE-116
<0.9.6 · fixed in 0.9.6

GHSA-v2qm-5wxj-qhj7 · CVE-2026-54013 Not analysed yet 17 Jun 2026
CVE-2025-48571 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 17 Jun 2026
CVE-2026-12457 CVE record

CVSS 4.2 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 17 Jun 2026
CVE-2026-12438 CVE record

CVSS 8.3 High

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 17 Jun 2026
n8n npm

CVSS 5.3 Medium

n8n: Python Code Node AST Validator Bypass
- CWE-184
- CWE-693
<2.25.7 || >=2.26.0, <2.26.2 · fixed in 2.25.7, 2.26.2

GHSA-jwm3-qcfw-c5pp · CVE-2026-56777 Not analysed yet 16 Jun 2026
openclaw npm

CVSS 8.3 High

Duplicate Advisory: Linux and macOS exec allowlists skipped configured argument patterns
- CWE-693
* · no fixed version yet

GHSA-3v3j-737j-7g74 Withdrawn Not analysed yet 16 Jun 2026
openclaw npm

CVSS 4.3 Medium

Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks
- CWE-693
<=2026.5.5 · no fixed version yet

GHSA-r7vv-6763-m739 Withdrawn Not analysed yet 16 Jun 2026
deno crates.io

CVSS 5.2 Medium

Deno: `fetch()` API sandbox bypass via missing DNS resolution check
- Server-side request forgery (SSRF)
- CWE-693
<2.8.1 · fixed in 2.8.1

GHSA-cpgj-f7g3-2pp2 · CVE-2026-49859 Not analysed yet 16 Jun 2026
CVE-2026-12316 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12315 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12302 CVE record

CVSS 6.5 Medium

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12296 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-403
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12295 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-653
- CWE-693
Not analysed yet 16 Jun 2026
CVE-2026-12294 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
- CWE-693
Not analysed yet 16 Jun 2026
dompurify npm

CVSS 5.1 Medium

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
- CWE-693
<3.4.9 · fixed in 3.4.9

GHSA-vxr8-fq34-vvx9 · CVE-2026-65899 Not analysed yet 15 Jun 2026
dompurify npm

CVSS 5.3 Medium

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
- CWE-501
- CWE-693
<3.4.7 · fixed in 3.4.7

GHSA-76mc-f452-cxcm · CVE-2026-65902 Not analysed yet 15 Jun 2026
dompurify npm

CVSS 6.1 Medium

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- Cross-site scripting (XSS)
- CWE-501
<3.4.6 · fixed in 3.4.6

GHSA-hpcv-96wg-7vj8 · CVE-2026-49458 Not analysed yet 15 Jun 2026
dompurify npm

CVSS 6.1 Medium

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- Cross-site scripting (XSS)
- Prototype pollution
<3.4.6 · fixed in 3.4.6

GHSA-r47g-fvhr-h676 · CVE-2026-49459 Not analysed yet 15 Jun 2026
CVE-2026-12214 CVE record

CVSS 8.5 High

Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism
- Qihoo 360 Total Security
- CWE-693
Not analysed yet 15 Jun 2026
CVE-2026-12031 CVE record

CVSS 8.3 High

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 11 Jun 2026
CVE-2026-12027 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Protection mechanism failure in Google Chrome
- Google Chrome
- Privilege escalation
- CWE-693
Not analysed yet 11 Jun 2026
CVE-2025-30431 CVE record

CVSS 5.5 Medium

Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
Not analysed yet 11 Jun 2026
CVE-2025-24284 CVE record

CVSS 8.8 High

Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
Not analysed yet 11 Jun 2026
CVE-2026-48546 CVE record

CVSS 8.5 High

KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs
- lingdojo kana-dojo
- CWE-693
Not analysed yet 11 Jun 2026
@hulumi/baseline npm

CVSS 6.3 Medium

@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
- CWE-693
<1.4.0 · fixed in 1.4.0

GHSA-cj8g-prcm-mfg5 · CVE-2026-48037 Not analysed yet 10 Jun 2026
@hulumi/policies npm

CVSS 8.4 High

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
- CWE-693
<1.4.0 · fixed in 1.4.0

GHSA-rhgj-6g2c-frmm · CVE-2026-48033 Not analysed yet 10 Jun 2026
CVE-2026-47656 CVE record

CVSS 7.9 High

Windows Boot Manager Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-45595 CVE record

CVSS 5.4 Medium

Windows Mark of the Web Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-45459 CVE record

CVSS 3.3 Low

Microsoft Excel Security Feature Bypass Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office 365 for Mac
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-48575 CVE record

CVSS 7.9 High

Secure Boot Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-48570 CVE record

CVSS 7.9 High

Secure Boot Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-48568 CVE record

CVSS 7.9 High

Secure Boot Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-45588 CVE record

CVSS 7.9 High

Secure Boot Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-45656 CVE record

CVSS 7.8 High

UEFI Secure Boot Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-45655 CVE record

CVSS 5.3 Medium

Windows BitLocker Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
Not analysed yet 9 Jun 2026
CVE-2026-11695 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 8 Jun 2026
CVE-2026-11684 CVE record

CVSS 3.1 Low

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 8 Jun 2026
actual npm

CVSS 4.8 Medium

actual Allows Electron to Run As Node
- Code injection
- Privilege escalation
<26.5.0 · fixed in 26.5.0

GHSA-7rvm-xjpp-63r9 · CVE-2026-42890 Not analysed yet 8 Jun 2026
twig/twig Packagist

CVSS 8.7 High

Twig: Possible sandbox bypass when using a source policy
- CWE-693
>=2.16.0, <=2.16.1 || >=3.9.0, <3.26.0 · fixed in 3.26.0

GHSA-2q52-x2ff-qgfr · CVE-2026-24425 Not analysed yet 5 Jun 2026
CVE-2026-11292 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11288 CVE record

CVSS 6.5 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11282 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11266 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11264 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11263 CVE record

CVSS 6.5 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11260 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11248 CVE record

CVSS 8.8 High

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11247 CVE record

CVSS 3.1 Low

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11234 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11219 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11206 CVE record

CVSS 6.5 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11174 CVE record

CVSS 5.3 Medium

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026
CVE-2026-11170 CVE record

CVSS 8.1 High

Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
Not analysed yet 4 Jun 2026