# CWE-914.

Every Advisory and CVE whose sources give the weakness CWE-914, newest first.

## Records, newest first

- [YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution](https://agentprime.io/advisories/CVE-2019-25777.md)
  `CVE-2019-25777` · CVE record · CVSS 7.3 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization, CWE-914
- [toui allows user-specific variables to be shared between users](https://agentprime.io/advisories/GHSA-hh7j-pg39-q563.md)
  `GHSA-hh7j-pg39-q563`, `CVE-2023-33175`, `PYSEC-2026-555` · PyPI `toui`: affected `>=2.0.1, <2.4.1`, fixed in `2.4.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-914
- [vm2 has a Sandbox Escape Vulnerability](https://agentprime.io/advisories/GHSA-qcp4-v2jj-fjx8.md)
  `GHSA-qcp4-v2jj-fjx8`, `CVE-2026-44006` · npm `vm2`: affected `<3.11.0`, fixed in `3.11.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Code injection, CWE-914
- [Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr](https://agentprime.io/advisories/GHSA-69v7-xpr6-6gjm.md)
  `GHSA-69v7-xpr6-6gjm`, `CVE-2026-34444`, `PYSEC-2026-2613` · PyPI `lupa`: affected `<=2.6`, no fixed version yet · CVSS 7.9 High · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control, CWE-693, CWE-914
- [Chyrp Lite has an IDOR via Mass Assignment in Post Model](https://agentprime.io/advisories/CVE-2026-35173.md)
  `CVE-2026-35173` · CVE record: xenocrat chyrp-lite · CVSS 6.5 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Broken access control, CWE-914
- [youlaitech youlai-mall orders improper control of dynamically-identified variables](https://agentprime.io/advisories/CVE-2025-14085.md)
  `CVE-2025-14085` · CVE record: youlaitech youlai-mall · CVSS 5.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-913, CWE-914
- [youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables](https://agentprime.io/advisories/CVE-2025-14051.md)
  `CVE-2025-14051` · CVE record: youlaitech youlai-mall · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-913, CWE-914
- [Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP](https://agentprime.io/advisories/CVE-2024-54198.md)
  `CVE-2024-54198` · CVE record: SAP_SE SAP NetWeaver Application Server ABAP · CVSS 8.5 High · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-914
- [Authenticated Gaia users can inject code or commands by global variables through special HTTP requests.](https://agentprime.io/advisories/CVE-2024-24914.md)
  `CVE-2024-24914` · CVE record: checkpoint ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management · CVSS 8.0 High · Not analysed yet · Published 7 Nov 2024 · Tags: CWE-914

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-914>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-914/>. Everything for agents: <https://agentprime.io/llms.txt>.