CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
9394 vulnerabilities reference this CWE, most recent first.
GHSA-F8Q9-F337-2P3R
Vulnerability from github – Published: 2026-08-19 18:32 – Updated: 2026-08-20 18:30A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
{
"affected": [],
"aliases": [
"CVE-2026-72530"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T17:21:01Z",
"severity": "CRITICAL"
},
"details": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"id": "GHSA-f8q9-f337-2p3r",
"modified": "2026-08-20T18:30:42Z",
"published": "2026-08-19T18:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72530"
},
{
"type": "WEB",
"url": "https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment"
},
{
"type": "WEB",
"url": "https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F8RC-7CQG-V9MM
Vulnerability from github – Published: 2024-08-08 12:30 – Updated: 2024-08-08 12:30An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
{
"affected": [],
"aliases": [
"CVE-2024-3958"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-08T11:15:12Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.",
"id": "GHSA-f8rc-7cqg-v9mm",
"modified": "2024-08-08T12:30:35Z",
"published": "2024-08-08T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3958"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2437784"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/456988"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8W6-8HPV-RRJJ
Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
{
"affected": [],
"aliases": [
"CVE-2026-42898"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T18:17:26Z",
"severity": "CRITICAL"
},
"details": "Improper control of generation of code (\u0027code injection\u0027) in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.",
"id": "GHSA-f8w6-8hpv-rrjj",
"modified": "2026-05-12T18:30:47Z",
"published": "2026-05-12T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42898"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F8WV-XP27-6GQ7
Vulnerability from github – Published: 2026-09-17 20:44 – Updated: 2026-09-17 20:44Affected versions and vulnerable location
- Confirmed on grav core at
78ebfc1(tag 2.0.13). - Sinks:
system/src/Grav/Common/Data/Blueprint.php:455-458call_user_func_array($o, $params)(bare-function dynamic-data provider).- Twin:
system/src/Grav/Framework/Flex/FlexDirectory.php:936-938call_user_func_array($function, $params). - Validation gate:
Blueprint::isSafeDynamicCall()atBlueprint.php:514-536. Class::methodbranch (:514-527) uses a strict positive allowlistself::$allowedDynamicCallables.- Bare-function branch (
:530-534) uses only a denylist:if (is_string($function) && Utils::isDangerousFunction($function)) return false; return !self::paramsContainDangerousCallable($params);. - Denylist:
Utils::isDangerousFunction()(system/src/Grav/Common/Utils.php, list around:2020-2270).
Root cause
GHSA-7pgq/CVE-2026-64850 hardened the Class::method half of the dynamic-callable validation to a positive allowlist because a page-edit account could otherwise name any static method as a provider and reach file/secret gadgets. The bare-function half was left on a denylist (isDangerousFunction). Any bare PHP function not on that list executes.
error_log is not on the denylist (verified: no occurrence in Utils.php). error_log($message, 3, $destination) appends attacker-controlled $message to attacker-controlled file $destination, an arbitrary-file-append primitive. paramsContainDangerousCallable() (:587-603) only scans params for dangerous callable strings, so a PHP payload string and a destination path both pass. (stream_socket_client, dl, and mb_send_mail are likewise absent, giving SSRF/other primitives.)
Attacker model
The same surface the published dynamic-data advisories accept as reachable: a data-*@ directive in a form blueprint the Form plugin assembles from page frontmatter (GHSA-fj2p), or a data@ field in a Flex directory/pages/users blueprint (GHSA-c4wf). A page-edit / blueprint-config account, no shell.
Reachability trace
- Author a blueprint field with a bare-function data directive, e.g.
data-options@: ['error_log', '<?php system($_GET[0]); ?>', 3, 'user/data/x.php']. Blueprint::init()resolves the directive;isSafeDynamicCall('error_log', $params)reaches the bare-function branch (:530),isDangerousFunction('error_log')is false,paramsContainDangerousCallable([...])is false (no callable strings), so it returns true.call_user_func_array('error_log', ['<?php ...', 3, 'user/data/x.php'])(:455) appends the PHP payload touser/data/x.php.- Writing to a web-served path (or any path later included) yields code execution. The upload extension denylist does not apply, this is a direct
error_logwrite, not an upload.
Reproduction
Executed end to end against the real Grav\Common\Data\Blueprint class loaded via composer install autoload (PHP 8.5.8, core clone at HEAD 78ebfc1). A harness called the real public Blueprint::isSafeDynamicCall(), then drove the sink and executed the written file:
[1] isSafeDynamicCall('error_log', [payload,3,dest]) => true # guard ACCEPTS error_log (bug)
[2] isSafeDynamicCall('system', ['id']) => false # control
isSafeDynamicCall('exec', ['id']) => false # control
[3] call_user_func_array('error_log', ['<?php echo "PWNED"; ?>'.EOL, 3, '/tmp/grav_rce_proof.php'])
file written: /tmp/grav_rce_proof.php (23 bytes) = <?php echo "PWNED"; ?>
[4] php /tmp/grav_rce_proof.php => PWNED # arbitrary PHP executed (RCE)
The guard returns true for error_log (and false for the denylisted system/exec controls), the error_log sink wrote attacker PHP to disk, and executing that file yielded PWNED. Source confirmation:
rg -n "error_log|stream_socket_client|mb_send_mail" system/src/Grav/Common/Utils.php # no hits
rg -n "isDangerousFunction|allowedDynamicCallables|call_user_func_array" system/src/Grav/Common/Data/Blueprint.php
error_log absent from Utils.php; Blueprint.php gates the bare-function branch on isDangerousFunction only, while the Class::method branch uses the positive allowlist.
Suggested fix
Convert the bare-function branch to a positive allowlist, symmetric with the Class::method allowlist at :523 (only the option-provider functions first-party blueprints actually use). A denylist cannot be complete: error_log (arbitrary append), stream_socket_client (SSRF), and others must otherwise each be enumerated.
Severity and CVSS reasoning
Suggested severity: High (same class and reach as GHSA-fj2p / CVE-2026-64850).
Suggested CVSS:3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.6) for the RCE outcome; the maintainer may prefer the exact rating they gave GHSA-fj2p.
PR:L: a blueprint/page-edit account, not super.C:H/I:H/A:H: arbitrary file write leading to code execution.
How I found it and a note on tooling
I compared the two branches of isSafeDynamicCall(): the Class::method branch is a positive allowlist (the GHSA-7pgq fix) while the bare-function branch is a denylist, then checked the denylist for append/exec-capable functions and found error_log missing. I used AI assistance for enumeration and drafting. I then executed the real Blueprint::isSafeDynamicCall() (loaded via composer autoload) to confirm it accepts error_log and rejects system/exec, and drove the error_log sink to write and execute attacker PHP. Verification is executed end to end against the real class; I did not run it through a full HTTP request into a bootstrapped Grav site.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.14"
},
"package": {
"ecosystem": "Packagist",
"name": "getgrav/grav"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-75827"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T20:44:16Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Affected versions and vulnerable location\n\n- Confirmed on grav core at `78ebfc1` (tag 2.0.13).\n- Sinks:\n - `system/src/Grav/Common/Data/Blueprint.php:455-458` `call_user_func_array($o, $params)` (bare-function dynamic-data provider).\n - Twin: `system/src/Grav/Framework/Flex/FlexDirectory.php:936-938` `call_user_func_array($function, $params)`.\n- Validation gate: `Blueprint::isSafeDynamicCall()` at `Blueprint.php:514-536`.\n - `Class::method` branch (`:514-527`) uses a strict positive allowlist `self::$allowedDynamicCallables`.\n - Bare-function branch (`:530-534`) uses only a denylist: `if (is_string($function) \u0026\u0026 Utils::isDangerousFunction($function)) return false; return !self::paramsContainDangerousCallable($params);`.\n- Denylist: `Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`, list around `:2020-2270`).\n\n## Root cause\n\nGHSA-7pgq/CVE-2026-64850 hardened the `Class::method` half of the dynamic-callable validation to a positive allowlist because a page-edit account could otherwise name any static method as a provider and reach file/secret gadgets. The bare-function half was left on a denylist (`isDangerousFunction`). Any bare PHP function not on that list executes.\n\n`error_log` is not on the denylist (verified: no occurrence in `Utils.php`). `error_log($message, 3, $destination)` appends attacker-controlled `$message` to attacker-controlled file `$destination`, an arbitrary-file-append primitive. `paramsContainDangerousCallable()` (`:587-603`) only scans params for dangerous callable strings, so a PHP payload string and a destination path both pass. (`stream_socket_client`, `dl`, and `mb_send_mail` are likewise absent, giving SSRF/other primitives.)\n\n## Attacker model\n\nThe same surface the published dynamic-data advisories accept as reachable: a `data-*@` directive in a form blueprint the Form plugin assembles from page frontmatter (GHSA-fj2p), or a `data@` field in a Flex directory/pages/users blueprint (GHSA-c4wf). A page-edit / blueprint-config account, no shell.\n\n## Reachability trace\n\n1. Author a blueprint field with a bare-function data directive, e.g.\n `data-options@: [\u0027error_log\u0027, \u0027\u003c?php system($_GET[0]); ?\u003e\u0027, 3, \u0027user/data/x.php\u0027]`.\n2. `Blueprint::init()` resolves the directive; `isSafeDynamicCall(\u0027error_log\u0027, $params)` reaches the bare-function branch (`:530`), `isDangerousFunction(\u0027error_log\u0027)` is false, `paramsContainDangerousCallable([...])` is false (no callable strings), so it returns true.\n3. `call_user_func_array(\u0027error_log\u0027, [\u0027\u003c?php ...\u0027, 3, \u0027user/data/x.php\u0027])` (`:455`) appends the PHP payload to `user/data/x.php`.\n4. Writing to a web-served path (or any path later included) yields code execution. The upload extension denylist does not apply, this is a direct `error_log` write, not an upload.\n\n## Reproduction\n\nExecuted end to end against the real `Grav\\Common\\Data\\Blueprint` class loaded via `composer install` autoload (PHP 8.5.8, core clone at HEAD 78ebfc1). A harness called the real public `Blueprint::isSafeDynamicCall()`, then drove the sink and executed the written file:\n\n```text\n[1] isSafeDynamicCall(\u0027error_log\u0027, [payload,3,dest]) =\u003e true # guard ACCEPTS error_log (bug)\n[2] isSafeDynamicCall(\u0027system\u0027, [\u0027id\u0027]) =\u003e false # control\n isSafeDynamicCall(\u0027exec\u0027, [\u0027id\u0027]) =\u003e false # control\n[3] call_user_func_array(\u0027error_log\u0027, [\u0027\u003c?php echo \"PWNED\"; ?\u003e\u0027.EOL, 3, \u0027/tmp/grav_rce_proof.php\u0027])\n file written: /tmp/grav_rce_proof.php (23 bytes) = \u003c?php echo \"PWNED\"; ?\u003e\n[4] php /tmp/grav_rce_proof.php =\u003e PWNED # arbitrary PHP executed (RCE)\n```\n\nThe guard returns true for `error_log` (and false for the denylisted `system`/`exec` controls), the `error_log` sink wrote attacker PHP to disk, and executing that file yielded `PWNED`. Source confirmation:\n\n```bash\nrg -n \"error_log|stream_socket_client|mb_send_mail\" system/src/Grav/Common/Utils.php # no hits\nrg -n \"isDangerousFunction|allowedDynamicCallables|call_user_func_array\" system/src/Grav/Common/Data/Blueprint.php\n```\n\n`error_log` absent from `Utils.php`; `Blueprint.php` gates the bare-function branch on `isDangerousFunction` only, while the `Class::method` branch uses the positive allowlist.\n\n## Suggested fix\n\nConvert the bare-function branch to a positive allowlist, symmetric with the `Class::method` allowlist at `:523` (only the option-provider functions first-party blueprints actually use). A denylist cannot be complete: `error_log` (arbitrary append), `stream_socket_client` (SSRF), and others must otherwise each be enumerated.\n\n## Severity and CVSS reasoning\n\nSuggested severity: High (same class and reach as GHSA-fj2p / CVE-2026-64850).\n\nSuggested CVSS:3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` (9.6) for the RCE outcome; the maintainer may prefer the exact rating they gave GHSA-fj2p.\n\n- `PR:L`: a blueprint/page-edit account, not super.\n- `C:H/I:H/A:H`: arbitrary file write leading to code execution.\n\n## How I found it and a note on tooling\n\nI compared the two branches of `isSafeDynamicCall()`: the `Class::method` branch is a positive allowlist (the GHSA-7pgq fix) while the bare-function branch is a denylist, then checked the denylist for append/exec-capable functions and found `error_log` missing. I used AI assistance for enumeration and drafting. I then executed the real `Blueprint::isSafeDynamicCall()` (loaded via composer autoload) to confirm it accepts `error_log` and rejects `system`/`exec`, and drove the `error_log` sink to write and execute attacker PHP. Verification is executed end to end against the real class; I did not run it through a full HTTP request into a bootstrapped Grav site.",
"id": "GHSA-f8wv-xp27-6gq7",
"modified": "2026-09-17T20:44:16Z",
"published": "2026-09-17T20:44:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-f8wv-xp27-6gq7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75827"
},
{
"type": "PACKAGE",
"url": "https://github.com/getgrav/grav"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/grav-before-arbitrary-file-write-via-error-log"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write"
}
GHSA-F8X4-PV8V-WWWR
Vulnerability from github – Published: 2022-05-01 23:54 – Updated: 2022-05-01 23:54Multiple PHP remote file inclusion vulnerabilities in MiGCMS 2.0.5, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[application][app_root] parameter to (1) collection.class.php and (2) content_image.class.php in lib/obj/.
{
"affected": [],
"aliases": [
"CVE-2008-2888"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-06-27T18:41:00Z",
"severity": "HIGH"
},
"details": "Multiple PHP remote file inclusion vulnerabilities in MiGCMS 2.0.5, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[application][app_root] parameter to (1) collection.class.php and (2) content_image.class.php in lib/obj/.",
"id": "GHSA-f8x4-pv8v-wwwr",
"modified": "2022-05-01T23:54:30Z",
"published": "2022-05-01T23:54:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2888"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43250"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/5901"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30770"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29874"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F92H-24FV-Q8VJ
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool.
{
"affected": [],
"aliases": [
"CVE-2020-27192"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-17T02:15:00Z",
"severity": "HIGH"
},
"details": "BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift\u0027s helper tool.",
"id": "GHSA-f92h-24fv-q8vj",
"modified": "2022-05-24T17:34:30Z",
"published": "2022-05-24T17:34:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27192"
},
{
"type": "WEB",
"url": "https://insinuator.net/2020/11/forklift-lpe"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F93P-5VR9-J8VQ
Vulnerability from github – Published: 2026-07-18 21:30 – Updated: 2026-07-18 21:30A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-16150"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T20:17:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-f93p-5vr9-j8vq",
"modified": "2026-07-18T21:30:23Z",
"published": "2026-07-18T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16150"
},
{
"type": "WEB",
"url": "https://github.com/RobinHerbots/Inputmask/issues/2885"
},
{
"type": "WEB",
"url": "https://github.com/RobinHerbots/Inputmask"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16150"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/856979"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379909"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379909/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F96G-5RMJ-PFHF
Vulnerability from github – Published: 2022-05-17 02:42 – Updated: 2025-04-20 03:38PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.
{
"affected": [],
"aliases": [
"CVE-2017-8402"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-31T04:29:00Z",
"severity": "HIGH"
},
"details": "PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.",
"id": "GHSA-f96g-5rmj-pfhf",
"modified": "2025-04-20T03:38:23Z",
"published": "2022-05-17T02:42:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8402"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/pivot-weblog/code/4489"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F987-FHWW-HFVP
Vulnerability from github – Published: 2022-05-14 01:31 – Updated: 2022-05-14 01:31Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2015-1645"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-04-14T20:59:00Z",
"severity": "HIGH"
},
"details": "Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka \"EMF Processing Remote Code Execution Vulnerability.\"",
"id": "GHSA-f987-fhww-hfvp",
"modified": "2022-05-14T01:31:24Z",
"published": "2022-05-14T01:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1645"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-035"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/131457/Microsoft-Windows-GDI-MRSETDIBITSTODEVICE-bPlay-EMF-Parsing-Memory-Corruption.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/535272/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032110"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F988-Q9M6-R9H6
Vulnerability from github – Published: 2022-11-02 12:00 – Updated: 2022-11-02 19:00The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Big Sur 11.7, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6. An app may be able to execute arbitrary code with kernel privileges.
{
"affected": [],
"aliases": [
"CVE-2022-32924"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-01T20:15:00Z",
"severity": "HIGH"
},
"details": "The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Big Sur 11.7, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6. An app may be able to execute arbitrary code with kernel privileges.",
"id": "GHSA-f988-q9m6-r9h6",
"modified": "2022-11-02T19:00:25Z",
"published": "2022-11-02T12:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32924"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213443"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213444"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213488"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213489"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213491"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213492"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/170010/XNU-Dangling-PTE-Entry.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.