https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 00:07:25 +0000 https://cve.radiocsirt.org/vuln/brew-cdxgen-ghsa-5vwr-qchf-q4pf <p><strong>Affected:</strong> Homebrew: cdxgen</p> <p>## Summary</p> <p>A command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3.</p> <p>When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with `shell: true`. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path.</p> <p>This could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context.</p> <p>The issue affected both the CLI and server mode. The issue is patched in `12.4.3`.</p> <p>## Affected asset</p> <p>- Project: cdxgen - Tested version: 12.4.1 - Mode tested: server mode - Endpoint: `POST /sbom` - Scanner path: Java / Maven project scanning</p> <p>## Patch</p> <p>Version 12.4.3 includes hardening for this issue with PR #4059</p> <p>The patch adds multiple mitigations:</p> <p>- Maven command invocations no longer use unconditional shell execution on POSIX platforms. - Bazel command invocation was similarly changed away from unconditional shell execution. - Windows compatibility is preserved using `shell: isWin` where needed. - `safeSpawnSync` now blocks `shell: true` invocations when the command or direct argument values contain shell metacharacters. - cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope.</p> <p>## Workarounds</p> <p>The recommended remediation is t…</p> <p><strong>Affected:</strong> Homebrew: cdxgen</p> <p>## Summary</p> <p>A command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3.</p> <p>When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with `shell: true`. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path.</p> <p>This could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context.</p> <p>The issue affected both the CLI and server mode. The issue is patched in `12.4.3`.</p> <p>## Affected asset</p> <p>- Project: cdxgen - Tested version: 12.4.1 - Mode tested: server mode - Endpoint: `POST /sbom` - Scanner path: Java / Maven project scanning</p> <p>## Patch</p> <p>Version 12.4.3 includes hardening for this issue with PR #4059</p> <p>The patch adds multiple mitigations:</p> <p>- Maven command invocations no longer use unconditional shell execution on POSIX platforms. - Bazel command invocation was similarly changed away from unconditional shell execution. - Windows compatibility is preserved using `shell: isWin` where needed. - `safeSpawnSync` now blocks `shell: true` invocations when the command or direct argument values contain shell metacharacters. - cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope.</p> <p>## Workarounds</p> <p>The recommended remediation is t…</p> https://cve.radiocsirt.org/vuln/brew-cdxgen-ghsa-5vwr-qchf-q4pf