Common Weakness Enumeration

CWE-470

Allowed

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

212 vulnerabilities reference this CWE, most recent first.

GHSA-MWJ6-RFH8-7QF4

Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23
VLAI
Summary
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Details

Summary

Hydra's legacy instantiate() target blocklists and related execution-policy collections are stored in mutable module-level state. Because _locate() can resolve attributes on imported objects, a configuration can resolve a mutation method such as .discard(), modify the active policy, and then instantiate a target that would otherwise be blocked.

Impact

A configuration controlling multiple sibling _target_ entries can first remove an entry from a target blocklist and then invoke the removed target. Sibling nodes are processed in insertion order and consult the same mutable module-level policy.

This affects the legacy/default path without an execution whitelist. The 1.3 blocklist is a defense-in-depth measure rather than a complete security boundary, and applications must not treat arbitrary untrusted configuration as safe to instantiate or use for Python logging configuration.

Released hydra-core versions 1.3.4 through 1.3.6 and 1.4.0.dev4 through 1.4.0.dev9 are affected. Fixed releases are 1.3.7 and 1.4.0.dev10. The reported direct mutation path does not bypass an execution whitelist restricted to intended application targets and supplied by trusted Python code. During remediation, Hydra additionally hardened generic discovery, dispatch, introspection, alias, callable-result, and deferred-callable paths that could otherwise undermine name-only authorization.

Technical details

In hydra-core 1.3.4 and 1.3.5, the mutable blocklist is reachable as:

hydra._internal.instantiate._instantiate2.DEFAULT_BLOCKLISTED_MODULES

In hydra-core 1.3.6, the expanded policy includes mutable collections in:

hydra._internal.target_policy

For example:

hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard

resolves to the bound set.discard method. The mutation target itself is not blocked on the legacy path. Once an entry is removed, subsequent authorization checks observe the modified set.

Other runtime policy collections can be attacked similarly by removing denied entries or adding entries to exception sets. Because the collections are module-level state, a successful mutation persists for the lifetime of the Python process unless explicitly reversed.

Safe reproduction

The behavior in hydra-core 1.3.6 can be demonstrated without invoking a shell command. The finally block restores the modified process-global state:

from omegaconf import OmegaConf

from hydra._internal.target_policy import UNCONTROLLED_EXECUTION_TARGETS
from hydra.utils import instantiate

target = "builtins.eval"
assert target in UNCONTROLLED_EXECUTION_TARGETS

try:
    result = instantiate(
        OmegaConf.create(
            {
                "disarm": {
                    "_target_": (
                        "hydra._internal.target_policy."
                        "UNCONTROLLED_EXECUTION_TARGETS.discard"
                    ),
                    "_args_": [target],
                },
                "proof": {
                    "_target_": target,
                    "_args_": ["40 + 2"],
                },
            }
        )
    )

    assert result["proof"] == 42
    assert target not in UNCONTROLLED_EXECUTION_TARGETS
finally:
    UNCONTROLLED_EXECUTION_TARGETS.add(target)

Remediation

The fix makes runtime policy state immutable and integrity checked, and prevents declarative configuration from accessing or mutating Hydra internals and protected Python implementation state. Target authorization now covers canonical resolved identities, aliases, discovery results, callable results, deferred callables, and runtime arguments.

The patch also rejects configuration-driven code, policy, and process- environment mutation, along with unsafe introspection and formatting traversal that can expose protected runtime capabilities.

Hydra 1.3.7 receives these protections as defense in depth; it does not make untrusted configuration sandboxed. Hydra 1.4 additionally uses a trusted, narrowly scoped execution whitelist as the supported security boundary for declarative instantiation and Hydra-controlled Python logging configuration.

Users should upgrade to hydra-core 1.3.7 on the stable line or 1.4.0.dev10 on the development line.

Workarounds

Do not pass configuration from untrusted sources to instantiate() or to Hydra-controlled Python logging configuration. The 1.3 release line has no execution-whitelist facility, so users who cannot upgrade immediately must restrict configuration input to trusted sources.

On affected 1.4 development releases, applications can also supply a trusted, narrowly scoped execution whitelist from Python code. The whitelist itself must not be derived from untrusted configuration.

Restart any long-running process that may already have instantiated untrusted configuration, because a policy mutation persists in process-global state.

Severity
8.5 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "hydra-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.4"
            },
            {
              "fixed": "1.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "hydra-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0.dev4"
            },
            {
              "fixed": "1.4.0.dev10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:23:57Z",
    "nvd_published_at": "2026-10-06T19:18:12Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nHydra\u0027s legacy `instantiate()` target blocklists and related execution-policy\ncollections are stored in mutable module-level state. Because `_locate()` can\nresolve attributes on imported objects, a configuration can resolve a mutation\nmethod such as `.discard()`, modify the active policy, and then instantiate a\ntarget that would otherwise be blocked.\n\n## Impact\n\nA configuration controlling multiple sibling `_target_` entries can first\nremove an entry from a target blocklist and then invoke the removed target.\nSibling nodes are processed in insertion order and consult the same mutable\nmodule-level policy.\n\nThis affects the legacy/default path without an execution whitelist. The 1.3\nblocklist is a defense-in-depth measure rather than a complete security\nboundary, and applications must not treat arbitrary untrusted configuration as\nsafe to instantiate or use for Python logging configuration.\n\nReleased `hydra-core` versions 1.3.4 through 1.3.6 and 1.4.0.dev4 through\n1.4.0.dev9 are affected. Fixed releases are 1.3.7 and 1.4.0.dev10.\nThe reported direct mutation path does not bypass an execution whitelist\nrestricted to intended application targets and supplied by trusted Python\ncode. During remediation, Hydra additionally hardened generic discovery,\ndispatch, introspection, alias, callable-result, and deferred-callable paths\nthat could otherwise undermine name-only authorization.\n\n## Technical details\n\nIn `hydra-core` 1.3.4 and 1.3.5, the mutable blocklist is reachable as:\n\n`hydra._internal.instantiate._instantiate2.DEFAULT_BLOCKLISTED_MODULES`\n\nIn `hydra-core` 1.3.6, the expanded policy includes mutable collections in:\n\n`hydra._internal.target_policy`\n\nFor example:\n\n`hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard`\n\nresolves to the bound `set.discard` method. The mutation target itself is not\nblocked on the legacy path. Once an entry is removed, subsequent authorization\nchecks observe the modified set.\n\nOther runtime policy collections can be attacked similarly by removing denied\nentries or adding entries to exception sets. Because the collections are\nmodule-level state, a successful mutation persists for the lifetime of the\nPython process unless explicitly reversed.\n\n## Safe reproduction\n\nThe behavior in `hydra-core` 1.3.6 can be demonstrated without invoking a shell\ncommand. The `finally` block restores the modified process-global state:\n\n```python\nfrom omegaconf import OmegaConf\n\nfrom hydra._internal.target_policy import UNCONTROLLED_EXECUTION_TARGETS\nfrom hydra.utils import instantiate\n\ntarget = \"builtins.eval\"\nassert target in UNCONTROLLED_EXECUTION_TARGETS\n\ntry:\n    result = instantiate(\n        OmegaConf.create(\n            {\n                \"disarm\": {\n                    \"_target_\": (\n                        \"hydra._internal.target_policy.\"\n                        \"UNCONTROLLED_EXECUTION_TARGETS.discard\"\n                    ),\n                    \"_args_\": [target],\n                },\n                \"proof\": {\n                    \"_target_\": target,\n                    \"_args_\": [\"40 + 2\"],\n                },\n            }\n        )\n    )\n\n    assert result[\"proof\"] == 42\n    assert target not in UNCONTROLLED_EXECUTION_TARGETS\nfinally:\n    UNCONTROLLED_EXECUTION_TARGETS.add(target)\n```\n\n## Remediation\n\nThe fix makes runtime policy state immutable and integrity checked, and\nprevents declarative configuration from accessing or mutating Hydra internals\nand protected Python implementation state. Target authorization now covers\ncanonical resolved identities, aliases, discovery results, callable results,\ndeferred callables, and runtime arguments.\n\nThe patch also rejects configuration-driven code, policy, and process-\nenvironment mutation, along with unsafe introspection and formatting traversal\nthat can expose protected runtime capabilities.\n\nHydra 1.3.7 receives these protections as defense in depth; it does not make\nuntrusted configuration sandboxed. Hydra 1.4 additionally uses a trusted,\nnarrowly scoped execution whitelist as the supported security boundary for\ndeclarative instantiation and Hydra-controlled Python logging configuration.\n\nUsers should upgrade to `hydra-core` 1.3.7 on the stable line or\n1.4.0.dev10 on the development line.\n\n## Workarounds\n\nDo not pass configuration from untrusted sources to `instantiate()` or to\nHydra-controlled Python logging configuration. The 1.3 release line has no\nexecution-whitelist facility, so users who cannot upgrade immediately must\nrestrict configuration input to trusted sources.\n\nOn affected 1.4 development releases, applications can also supply a trusted,\nnarrowly scoped execution whitelist from Python code. The whitelist itself must\nnot be derived from untrusted configuration.\n\nRestart any long-running process that may already have instantiated untrusted\nconfiguration, because a policy mutation persists in process-global state.",
  "id": "GHSA-mwj6-rfh8-7qf4",
  "modified": "2026-10-07T20:23:58Z",
  "published": "2026-10-07T20:23:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hydra-ecosystem/hydra"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Hydra: Mutable instantiate policy sets allow target blocklist bypass"
}

GHSA-P2H6-PJF9-J879

Vulnerability from github – Published: 2024-10-09 15:32 – Updated: 2025-11-03 21:31
VLAI
Details

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-8014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-09T15:15:16Z",
    "severity": "HIGH"
  },
  "details": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.",
  "id": "GHSA-p2h6-pjf9-j879",
  "modified": "2025-11-03T21:31:15Z",
  "published": "2024-10-09T15:32:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8014"
    },
    {
      "type": "WEB",
      "url": "https://docs.telerik.com/reporting/knowledge-base/insecure-type-resolution-cve-2024-8014"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20250425-0004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P46M-G734-VPC4

Vulnerability from github – Published: 2026-08-26 15:31 – Updated: 2026-08-26 15:31
VLAI
Summary
cakephp/debug_kit: MailPreview contains unsafe reflection
Details

Impact

The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:

  1. debug mode must be enabled.
  2. The hostname must match a 'local' domain or be in an allowlist.

Patches

5.2.4 and 4.10.3 contain patches for this issue.

Workarounds

Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "cakephp/debug_kit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "cakephp/debug_kit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54614"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T15:31:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe `MailPreview` feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:\n\n1. `debug` mode must be enabled.\n2. The hostname must match a \u0027local\u0027 domain or be in an allowlist.\n\n### Patches\n5.2.4 and 4.10.3 contain patches for this issue.\n\n### Workarounds\nEnsure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.",
  "id": "GHSA-p46m-g734-vpc4",
  "modified": "2026-08-26T15:31:01Z",
  "published": "2026-08-26T15:31:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/debug_kit/pull/1078"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cakephp/debug_kit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/debug_kit/releases/tag/4.10.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/debug_kit/releases/tag/5.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "cakephp/debug_kit: MailPreview contains unsafe reflection"
}

GHSA-PP9R-PPC4-25W4

Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-09-17 17:15
Withdrawn 2026-09-17 VLAI
Summary
Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-c4wf-2xxc-68qm. This link is maintained to preserve external references.

Original Description

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 2.0.9"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:15:05Z",
    "nvd_published_at": "2026-07-23T12:18:47Z",
    "severity": "HIGH"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-c4wf-2xxc-68qm. This link is maintained to preserve external references.\n\n### Original Description\nGrav versions \u003e= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.",
  "id": "GHSA-pp9r-ppc4-25w4",
  "modified": "2026-09-17T17:15:06Z",
  "published": "2026-07-23T12:32:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65608"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-flexdirectory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation",
  "withdrawn": "2026-09-17T17:15:05Z"
}

GHSA-PQ9P-WFFW-C523

Vulnerability from github – Published: 2023-09-11 21:30 – Updated: 2024-04-04 07:36
VLAI
Details

In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-35680"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-11T21:15:42Z",
    "severity": "MODERATE"
  },
  "details": "In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-pq9p-wffw-c523",
  "modified": "2024-04-04T07:36:50Z",
  "published": "2023-09-11T21:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35680"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2023-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PWG9-6G7W-XG4Q

Vulnerability from github – Published: 2026-09-18 18:31 – Updated: 2026-09-18 18:31
VLAI
Details

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-10853"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-18T16:17:05Z",
    "severity": "HIGH"
  },
  "details": "IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.",
  "id": "GHSA-pwg9-6g7w-xg4q",
  "modified": "2026-09-18T18:31:40Z",
  "published": "2026-09-18T18:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10853"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7284905"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q2R2-4MH9-4268

Vulnerability from github – Published: 2026-08-13 06:33 – Updated: 2026-08-13 06:33
VLAI
Details

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.

The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-19135"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T05:17:22Z",
    "severity": "MODERATE"
  },
  "details": "A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.\n\nThe solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.",
  "id": "GHSA-q2r2-4mh9-4268",
  "modified": "2026-08-13T06:33:50Z",
  "published": "2026-08-13T06:33:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19135"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenNMS/opennms/pull/8754"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q656-G2X3-8CGH

Vulnerability from github – Published: 2022-01-08 00:43 – Updated: 2022-01-07 23:21
VLAI
Summary
Kylin can receive user input and load any class through Class.forName(...).
Details

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.kylin:kylin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.kylin:kylin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-31522"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-07T23:21:51Z",
    "nvd_published_at": "2022-01-06T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.",
  "id": "GHSA-q656-g2x3-8cgh",
  "modified": "2022-01-07T23:21:51Z",
  "published": "2022-01-08T00:43:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/kylin/pull/1695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/kylin/pull/1763"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/kylin"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/01/06/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Kylin can receive user input and load any class through Class.forName(...)."
}

GHSA-QHMF-XW27-6RQR

Vulnerability from github – Published: 2026-06-25 21:31 – Updated: 2026-06-25 21:31
VLAI
Summary
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Details

Summary

MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments.

As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type.

Impact

Applications are affected when they deserialize untrusted payloads using typeless serialization features such as MessagePackSerializer.Typeless, TypelessObjectResolver, or related typeless resolver options.

Typeless deserialization is already a high-risk feature for untrusted data, but the presence of a disallowed-type hook creates an expectation that blocked types remain blocked. This issue weakens that mitigation because the check is not applied structurally to nested type components. An attacker who can supply typeless ext-100 payloads may bypass exact outer-type blocklist checks by naming wrapper types such as arrays or generic containers.

The consequence depends on which type is reached and what the application allows typeless deserialization to instantiate. The original findings describe bypasses involving blocked or user-blocklisted gadget types.

Affected components

  • Package: MessagePack
  • Feature: typeless deserialization
  • APIs: MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed, TypelessFormatter
  • Finding IDs: MESSAGEPACKCSHARP-030, duplicate/open variant MESSAGEPACKCSHARP-OPEN-007

Patches

Fixes are available via versions 2.5.301 and 3.1.7.

Upgrade guidance:

  1. Upgrade MessagePack to the patched version for your release line.
  2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.

The fix should apply type-disallow checks recursively to array element types, pointer/byref element types where applicable, nullable underlying types, and constructed generic type arguments. Formatter paths that materialize types supplied by the wire should not instantiate inner types that fail the configured policy.

Workarounds

Patching is recommended.

Avoid typeless deserialization for untrusted data. If typeless support is unavoidable, configure an explicit allowlist that rejects any type not approved by the application and ensure the allowlist recursively validates array elements and generic arguments. Do not rely on exact outer-type blocklists as a complete security boundary.

Resources

  • MESSAGEPACKCSHARP-030: typeless disallowed-type check is not recursive
  • MESSAGEPACKCSHARP-OPEN-007: duplicate/open finding for typeless blocklist gaps
  • CWE-502: Deserialization of Untrusted Data
  • CWE-470: Use of Externally-Controlled Input to Select Classes or Code

CVE split rationale

This vulnerability is independently fixable in typeless type-policy enforcement. It is separate from MVC default options, collection allocation, LZ4 decoding, and recursion-depth issues.

Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.301"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0"
            },
            {
              "fixed": "3.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-25T21:31:13Z",
    "nvd_published_at": "2026-06-22T22:16:48Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nMessagePack-CSharp\u0027s typeless deserialization includes `MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type)` as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments.\n\nAs a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type.\n\n## Impact\n\nApplications are affected when they deserialize untrusted payloads using typeless serialization features such as `MessagePackSerializer.Typeless`, `TypelessObjectResolver`, or related typeless resolver options.\n\nTypeless deserialization is already a high-risk feature for untrusted data, but the presence of a disallowed-type hook creates an expectation that blocked types remain blocked. This issue weakens that mitigation because the check is not applied structurally to nested type components. An attacker who can supply typeless ext-100 payloads may bypass exact outer-type blocklist checks by naming wrapper types such as arrays or generic containers.\n\nThe consequence depends on which type is reached and what the application allows typeless deserialization to instantiate. The original findings describe bypasses involving blocked or user-blocklisted gadget types.\n\n## Affected components\n\n- Package: `MessagePack`\n- Feature: typeless deserialization\n- APIs: `MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed`, `TypelessFormatter`\n- Finding IDs: `MESSAGEPACKCSHARP-030`, duplicate/open variant `MESSAGEPACKCSHARP-OPEN-007`\n\n## Patches\n\nFixes are available via versions 2.5.301 and 3.1.7.\n\nUpgrade guidance:\n\n1. Upgrade `MessagePack` to the patched version for your release line.\n2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.\n\nThe fix should apply type-disallow checks recursively to array element types, pointer/byref element types where applicable, nullable underlying types, and constructed generic type arguments. Formatter paths that materialize types supplied by the wire should not instantiate inner types that fail the configured policy.\n\n## Workarounds\n\nPatching is recommended.\n\nAvoid typeless deserialization for untrusted data. If typeless support is unavoidable, configure an explicit allowlist that rejects any type not approved by the application and ensure the allowlist recursively validates array elements and generic arguments. Do not rely on exact outer-type blocklists as a complete security boundary.\n\n## Resources\n\n- `MESSAGEPACKCSHARP-030`: typeless disallowed-type check is not recursive\n- `MESSAGEPACKCSHARP-OPEN-007`: duplicate/open finding for typeless blocklist gaps\n- CWE-502: Deserialization of Untrusted Data\n- CWE-470: Use of Externally-Controlled Input to Select Classes or Code\n\n## CVE split rationale\n\nThis vulnerability is independently fixable in typeless type-policy enforcement. It is separate from MVC default options, collection allocation, LZ4 decoding, and recursion-depth issues.",
  "id": "GHSA-qhmf-xw27-6rqr",
  "modified": "2026-06-25T21:31:13Z",
  "published": "2026-06-25T21:31:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhmf-xw27-6rqr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48517"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MessagePack-CSharp/MessagePack-CSharp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments"
}

GHSA-QQMF-GPG7-G8GW

Vulnerability from github – Published: 2026-07-15 18:31 – Updated: 2026-09-24 15:39
VLAI
Summary
PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters
Details

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.4 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lightning"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:51:19Z",
    "nvd_published_at": "2026-07-15T18:16:48Z",
    "severity": "HIGH"
  },
  "details": "PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.",
  "id": "GHSA-qqmf-gpg7-g8gw",
  "modified": "2026-09-24T15:39:46Z",
  "published": "2026-07-15T18:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58659"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lightning-AI/pytorch-lightning/issues/21822"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lightning-AI/pytorch-lightning/pull/21832"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lightning-AI/pytorch-lightning/commit/d710d689510d50e800f53b3cd773cbca20b1f86f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Lightning-AI/pytorch-lightning"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-qqmf-gpg7-g8gw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/lightning/PYSEC-2026-3624.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2026-3967.yaml"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": " PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters"
}
Mitigation
Architecture and Design

Refactor your code to avoid using reflection.

Mitigation
Architecture and Design

Do not use user-controlled inputs to select and load classes or code.

Mitigation
Implementation

Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.

CAPEC-138: Reflection Injection

An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application.

← Back to the CWE list