CWE-829.

Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

• CWE-829

<3.18.0 · fixed in 3.18.0

LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

• hiyouga LlamaFactory
• Code injection
• CWE-829

Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load

• Snowflake CLI
• Server-side request forgery (SSRF)
• CWE-829

PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

• Path traversal
• Code injection

<4.6.34 · fixed in 4.6.34

PraisonAI Vulnerable Untrusted Remote Template Code Execution

• CWE-829

<4.5.128 · fixed in 4.5.128

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

• CWE-345
• CWE-494

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

• Command injection
• CWE-494

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

• CWE-346
• CWE-693

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

MISP remote code execution via arbitrary rdkafka configuration path

• misp
• CWE-829

containerd: CRI checkpoint import allows local image tag poisoning

• CWE-345
• CWE-829

>=2.1.0, <2.1.9 || >=2.2.0, <2.2.5 || >=2.3.0, <2.3.2 · fixed in 2.1.9, 2.2.5, 2.3.2

[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

• CWE-829
• CWE-1427

<1.71.0 · fixed in 1.71.0

[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

• CWE-829

<1.69.0 · fixed in 1.69.0

[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

• Information disclosure
• CWE-829

<1.71.0 · fixed in 1.71.0

[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

• CWE-829
• CWE-1427

<1.71.0 · fixed in 1.71.0

Dell PowerFlex: Dell PowerFlex Manager, version(s) prior to 5.1.0.1…

• Dell PowerFlex
• CWE-829

Pi Agent: Pi loads project-local extensions without approval

• CWE-829

<0.79.0 · fixed in 0.79.0

Cursor Desktop sandbox escape via Claude hook configuration

• cursor
• Code injection
• CWE-829

DoS + Remote Code Execution via PDF JavaScript in Foxit AI

• Foxit Software Inc. Foxit AI
• CWE-829

Duck Site: Untrusted pull request code can trigger privileged production deployment

• duck-organization duck-site
• CWE-829

Vim: Arbitrary Code Execution via Python Omni-Completion

• vim
• Code injection
• CWE-829

Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.

• duck-organization quest-bot
• CWE-829

PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

• Code injection
• CWE-829

<2.27.0 · fixed in 2.27.0

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

• mate-desktop atril
• Command injection
• CWE-829

Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability

• Microsoft Visual Studio Code - MSSQL Extension
• Code injection
• CWE-829

Google Chrome: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53…

• Google Chrome
• CWE-829

CVE-2026-8879

• Securly Chrome Extension
• CWE-829

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

• CWE-829

<5.5.0 · fixed in 5.5.0

Synology Active Backup for Business Recovery Media Creator: An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL…

• Synology Active Backup for Business Recovery Media Creator
• CWE-829

Synology Hyper Backup Explorer: An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL…

• Synology Hyper Backup Explorer
• CWE-829

PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

• Path traversal
• Code injection

<4.6.40 · fixed in 4.6.40

Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint

• espressif shared-github-dangerjs
• CWE-427
• CWE-829

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

• CWE-829

>=2.9.0, <6.0.1 · fixed in 6.0.1

Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading

• Docker Desktop
• CWE-829

Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends

• Docker Desktop
• CWE-829

Concrete CMS is Vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-829

<9.5.1 · fixed in 9.5.1

Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`

• Cross-site request forgery (CSRF)
• CWE-829

<9.5.1 · fixed in 9.5.1

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

• Path traversal
• CWE-829

<1.30.0 · fixed in 1.30.0

Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading

• Rapid7 Metasploit Pro
• Broken access control
• CWE-427

Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

• CWE-829

<2026.4.20 · fixed in 2026.4.20

Kdenlive: Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled…

• Kdenlive
• CWE-829

Electerm users can run dangrous code through link or command line

• Code injection
• CWE-20

>=3.0.6, <3.8.8 · fixed in 3.8.8

Electerm runWidget has a path traversal that leads to arbitrary code execution

• Path traversal
• CWE-829

<3.7.16 · fixed in 3.7.16

vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

• Broken access control
• CWE-829

>=3.10.5, <3.11.0 · fixed in 3.11.0

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

• Weak cryptography or TLS
• CWE-829

<1.22.0 || >=2.0.0, <2.1.0 · fixed in 1.22.0, 2.1.0

Compromise of PyTorch Lightning PyPi Package Versions

• CWE-506
• CWE-829

=2.6.2 || =2.6.3 · no fixed version yet

OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere

• Command injection
• CWE-829

>=1.0.0, <11.6.0 · fixed in 11.6.0

OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

• CWE-829

<35.0.1 · fixed in 35.0.1

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

• CWE-829

<26.1 · fixed in 26.1

OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

• CWE-427
• CWE-454

<2026.4.20 · fixed in 2026.4.20

Duplicate Advisory: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

• CWE-829

<2026.3.28 · fixed in 2026.3.28

Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

• CWE-829

<2026.3.31 · fixed in 2026.3.31

InstructLab Includes Functionality from Untrusted Control Sphere

• CWE-829

<=0.26.1 · no fixed version yet

Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence

• patrickhener goshs
• CWE-829

iTerm2: In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p…

• iTerm2
• CWE-829

OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins

• CWE-829

<2026.4.9 · fixed in 2026.4.9

OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows

• Broken access control
• CWE-829

<2026.4.10 · fixed in 2026.4.10

Local Privilege Escalation via OpenSSL configuration file in Insight Agent

• Rapid7 Insight Agent
• CWE-829

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

• Luanti
• CWE-829

PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence

• MervinPraison PraisonAI
• CWE-829

PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

• Code injection
• CWE-426

<4.5.128 · fixed in 4.5.128