https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T10:13:23.396981+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349071 EUVD-2026-349071 2026-10-17T10:13:23.445740+00:00 EUVD-2026-349071 https://cve.radiocsirt.org/vuln/fkie_cve-2026-51190 fkie_cve-2026-51190 2026-10-17T10:13:23.445778+00:00

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.

 https://cve.radiocsirt.org/vuln/ghsa-rm7q-w9c9-27rj GHSA-rm7q-w9c9-27rj 2026-10-17T10:13:23.445811+00:00

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.