CWE-791
AllowedIncomplete Filtering of Special Elements
Abstraction: Base · Status: Incomplete
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
78 vulnerabilities reference this CWE, most recent first.
GHSA-3VHR-RRHF-P2MJ
Vulnerability from github – Published: 2026-03-08 09:30 – Updated: 2026-03-08 09:30A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java of the component FreeMarker Template Handler. Executing a manipulation of the argument template_content can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-3725"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-08T09:16:18Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java of the component FreeMarker Template Handler. Executing a manipulation of the argument template_content can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3vhr-rrhf-p2mj",
"modified": "2026-03-08T09:30:21Z",
"published": "2026-03-08T09:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3725"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.349703"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.349703"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.766459"
},
{
"type": "WEB",
"url": "https://www.notion.so/SmartAdmin-Server-Side-Template-Injection-SSTI-in-Email-Template-Rendering-310ea92a3c418087ac63ec8e5a061b62"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4P4W-6HG8-63WX
Vulnerability from github – Published: 2025-06-04 18:30 – Updated: 2025-11-03 21:33Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects AngularJS versions greater than or equal to 1.3.1.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "angular-sanitize"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.1"
},
{
"last_affected": "1.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-2336"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-06T23:38:46Z",
"nvd_published_at": "2025-06-04T17:15:28Z",
"severity": "MODERATE"
},
"details": "Improper sanitization of the value of the \u0027href\u0027 and \u0027xlink:href\u0027 attributes in \u0027\u003cimage\u003e\u0027 SVG elements in AngularJS\u0027s\u00a0\u0027ngSanitize\u0027\u00a0module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing \u00a0and also negatively affect the application\u0027s performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .",
"id": "GHSA-4p4w-6hg8-63wx",
"modified": "2025-11-03T21:33:59Z",
"published": "2025-06-04T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2336"
},
{
"type": "WEB",
"url": "https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c"
},
{
"type": "PACKAGE",
"url": "https://github.com/angular/angular.js"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2025-2336"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "AngularJS Incomplete Filtering of Special Elements vulnerability"
}
GHSA-5PJ7-9H42-MFX3
Vulnerability from github – Published: 2024-11-12 03:30 – Updated: 2024-11-12 03:30An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.
{
"affected": [],
"aliases": [
"CVE-2024-47590"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:04Z",
"severity": "HIGH"
},
"details": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.",
"id": "GHSA-5pj7-9h42-mfx3",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47590"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3520281"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5W28-7MVJ-3C7J
Vulnerability from github – Published: 2024-03-24 03:30 – Updated: 2025-03-29 00:31The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action.
{
"affected": [],
"aliases": [
"CVE-2020-36827"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-24T01:15:45Z",
"severity": "MODERATE"
},
"details": "The XAO::Web module before 1.84 for Perl mishandles \u003c and \u003e characters in JSON output during use of json-embed in Web::Action.",
"id": "GHSA-5w28-7mvj-3c7j",
"modified": "2025-03-29T00:31:30Z",
"published": "2024-03-24T03:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36827"
},
{
"type": "WEB",
"url": "https://github.com/amaltsev/XAO-Web/commit/20dd1d3bc5b811503f5722a16037b60197fe7ef4"
},
{
"type": "WEB",
"url": "https://metacpan.org/dist/XAO-Web/changes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-69M2-CJ73-P6PP
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-9498"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-25T20:16:38Z",
"severity": "LOW"
},
"details": "A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-69m2-cj73-p6pp",
"modified": "2026-05-26T13:30:50Z",
"published": "2026-05-26T13:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9498"
},
{
"type": "WEB",
"url": "https://github.com/Ku4D3/bug_story/blob/main/report_02.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/814103"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/365481"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/365481/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6J4X-4J9G-2875
Vulnerability from github – Published: 2026-03-08 09:30 – Updated: 2026-03-08 09:30A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the component Incomplete Fix CVE-2024-36694. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-3714"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-08T07:16:13Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the component Incomplete Fix CVE-2024-36694. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-6j4x-4j9g-2875",
"modified": "2026-03-08T09:30:20Z",
"published": "2026-03-08T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3714"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1_ZCvICLKo8AOovDkKFHwsBxh-ciwbElS/view?usp=drive_link"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.349659"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.349659"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.765176"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7X27-G8RG-X87W
Vulnerability from github – Published: 2026-06-24 21:30 – Updated: 2026-07-17 21:47A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.
SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.
This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.
Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "angular"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0-rc.3"
},
{
"last_affected": "1.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-11998"
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-791"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-17T21:47:00Z",
"nvd_published_at": "2026-06-24T21:16:52Z",
"severity": "HIGH"
},
"details": "A flaw in AngularJS\u0027 Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim\u0027s browser session.\n\n\nSCE\u0027s purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, \u0027\u003ciframe\u003e\u0027 documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.\n\n\nThis issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.\n\n\nNote:\nThe AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the\u00a0 End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .",
"id": "GHSA-7x27-g8rg-x87w",
"modified": "2026-07-17T21:47:01Z",
"published": "2026-06-24T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11998"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-11998"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492579"
},
{
"type": "WEB",
"url": "https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8"
},
{
"type": "PACKAGE",
"url": "https://github.com/angular/angular.js"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-11998"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Angular\u0027s deprecated package has a Cross-Site Scripting issue"
}
GHSA-8364-HFQJ-PWM6
Vulnerability from github – Published: 2026-05-19 15:31 – Updated: 2026-10-05 18:39Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering
The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code execution or arbitrary file writes. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177), the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891), and non-HTTP strategies (CVE-2026-40453).
This issue affects Apache Camel: from 3.18.0 before 4.14.6, from 4.15.0 before 4.18.2.
Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.2. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-cxf-rest"
},
"ranges": [
{
"events": [
{
"introduced": "3.18.0"
},
{
"fixed": "4.14.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-cxf-rest"
},
"ranges": [
{
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "4.18.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47323"
],
"database_specific": {
"cwe_ids": [
"CWE-178",
"CWE-791"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-04T18:49:44Z",
"nvd_published_at": "2026-05-19T14:16:48Z",
"severity": "CRITICAL"
},
"details": "Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering\n\nThe CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code execution or arbitrary file writes. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177), the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891), and non-HTTP strategies (CVE-2026-40453).\n\n\nThis issue affects Apache Camel: from 3.18.0 before 4.14.6, from 4.15.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.2. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.",
"id": "GHSA-8364-hfqj-pwm6",
"modified": "2026-10-05T18:39:30Z",
"published": "2026-05-19T15:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47323"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-47323"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479869"
},
{
"type": "WEB",
"url": "https://camel.apache.org/security/CVE-2026-47323.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/camel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering"
}
GHSA-8648-MQ73-M727
Vulnerability from github – Published: 2026-09-30 00:32 – Updated: 2026-09-30 00:32A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-102771"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T22:17:08Z",
"severity": "LOW"
},
"details": "A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-8648-mq73-m727",
"modified": "2026-09-30T00:32:28Z",
"published": "2026-09-30T00:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102771"
},
{
"type": "WEB",
"url": "https://github.com/coolcj-stack/ThinkCMF-v8.0.1-SSTI-Vulnerability/blob/main/ThinkCMF_Vulnerability_Report_EN.docx"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-102771"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/943081"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/411468"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/411468/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8GFF-CF92-72PV
Vulnerability from github – Published: 2025-06-23 21:31 – Updated: 2025-06-25 14:12A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyspur"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-6518"
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-25T14:12:09Z",
"nvd_published_at": "2025-06-23T19:15:25Z",
"severity": "LOW"
},
"details": "A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-8gff-cf92-72pv",
"modified": "2025-06-25T14:12:09Z",
"published": "2025-06-23T21:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6518"
},
{
"type": "WEB",
"url": "https://github.com/PySpur-Dev/pyspur/issues/289"
},
{
"type": "PACKAGE",
"url": "https://github.com/PySpur-Dev/pyspur"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.313638"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.313638"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.593612"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.