CWE-693

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tinfoil-factory/netfoil"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-436",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T20:03:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nPotential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate.\n\n### Impact\nDepends on a local attackers ability to craft multiple questions and the remote DoH server supporting them.",
  "id": "GHSA-59qp-cfj3-rp64",
  "modified": "2026-07-07T20:03:49Z",
  "published": "2026-07-07T20:03:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-59qp-cfj3-rp64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinfoil-factory/netfoil"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "netfoil has a domain name filter bypass via multiple questions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-60086"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T15:16:49Z",
    "severity": "MODERATE"
  },
  "details": "PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft single or double-vector prompt injections that are classified as HIGH threat level and pass through unblocked to reach the model.",
  "id": "GHSA-5c3v-h6hw-4gx7",
  "modified": "2026-07-10T15:31:41Z",
  "published": "2026-07-10T15:31:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4r3p-w3mc-5v34"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60086"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-prompt-injection-defense-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20701"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T01:17:06Z",
    "severity": "HIGH"
  },
  "details": "An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to connect to a network share without user consent.",
  "id": "GHSA-5g2j-7mcf-43r8",
  "modified": "2026-03-25T21:30:28Z",
  "published": "2026-03-25T03:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20701"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126794"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126795"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126796"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.0.33"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:41:20Z",
    "nvd_published_at": "2026-06-17T17:16:40Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-hgrh-qx5j-jfwx. This link is maintained to preserve external references.\n\n## Original Description\n\nPickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.",
  "id": "GHSA-5gp7-4733-2w2v",
  "modified": "2026-06-18T14:41:20Z",
  "published": "2026-06-17T18:35:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-hgrh-qx5j-jfwx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71322"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/picklescan-unsafe-globals-check-bypass-via-pty-spawn-function"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Picklescan Bypasses Unsafe Globals Check using pty.spawn",
  "withdrawn": "2026-06-18T14:41:20Z"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-28903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T17:15:49Z",
    "severity": "MODERATE"
  },
  "details": "Secure Boot Security Feature Bypass Vulnerability",
  "id": "GHSA-5hc2-c69v-grvx",
  "modified": "2024-04-09T18:30:26Z",
  "published": "2024-04-09T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28903"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28903"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-techdocs-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-46976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-17T21:31:28Z",
    "nvd_published_at": "2024-09-17T21:15:12Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAn attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim\u0027s browser when browsing documentation or navigating to an attacker provided link.\n\n### Patches\n\nThis has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)\n",
  "id": "GHSA-5j94-f3mf-8685",
  "modified": "2024-09-17T21:31:28Z",
  "published": "2024-09-17T21:31:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46976"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-327",
      "CWE-693"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-21T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sever Name Indication (SNI) extension of an HTTP request to discover the destination domain and determine if the request needs to be decrypted. An attacker could exploit this vulnerability by sending a crafted request over TLS from a client to an unknown or controlled URL. A successful exploit could allow an attacker to bypass the decryption process of Cisco Umbrella SWG and allow malicious content to be downloaded to a host on a protected network. There are workarounds that address this vulnerability.",
  "id": "GHSA-5j9q-qmpc-xr4h",
  "modified": "2022-05-05T00:00:46Z",
  "published": "2022-04-22T00:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20805"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uswg-fdbps-xtTRKpp6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.1"
            },
            {
              "fixed": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-78",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:26:54Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe published npm package `praisonai` ships `dist/tools/utility-tools.js`, which exports a `shell(command)` helper described in source as:\n\n```text\nExecute shell command (safe version - read-only commands)\n```\n\nThe helper attempts to enforce a safe read-only command allowlist by checking only the first whitespace-delimited token:\n\n```ts\nconst safeCommands = [\u0027ls\u0027, \u0027cat\u0027, \u0027head\u0027, \u0027tail\u0027, \u0027wc\u0027, \u0027grep\u0027, \u0027find\u0027, \u0027echo\u0027, \u0027date\u0027, \u0027pwd\u0027, \u0027which\u0027];\nconst firstWord = command.split(/\\s+/)[0];\n\nif (!safeCommands.includes(firstWord)) {\n    return { success: false, error: `Command not allowed: ${firstWord}` };\n}\n```\n\nIt then passes the entire original string to Node `child_process.exec()`:\n\n```ts\nconst { stdout, stderr } = await execAsync(command, { timeout: 5000 });\n```\n\nBecause `exec()` runs the command through a shell, a command string that starts with an allowed command can append a second non-allowlisted command with shell metacharacters. For example, direct `printf \u003cmarker\u003e` is rejected, but `echo ok; printf \u003cmarker\u003e` is accepted and executes `printf`.\n\nThis bypasses the helper\u0027s safe-command policy and allows arbitrary shell commands to run with the PraisonAI process privileges when an application, agent, or integration exposes this helper to lower-trust users, prompts, model output, or plugin/tool input.\n\nThe PoV is deterministic and local-only. It installs only the npm package, runs harmless marker commands, and does not contact any live service after installation.\n\n## Technical Details\n\n`utility-tools.shell()` authorizes one token but executes the full shell string.\n\nSource-head implementation:\n\n```ts\nexport async function shell(command: string): Promise\u003cToolResult\u003cstring\u003e\u003e {\n    // Only allow safe read-only commands\n    const safeCommands = [\u0027ls\u0027, \u0027cat\u0027, \u0027head\u0027, \u0027tail\u0027, \u0027wc\u0027, \u0027grep\u0027, \u0027find\u0027, \u0027echo\u0027, \u0027date\u0027, \u0027pwd\u0027, \u0027which\u0027];\n    const firstWord = command.split(/\\s+/)[0];\n\n    if (!safeCommands.includes(firstWord)) {\n        return { success: false, error: `Command not allowed: ${firstWord}` };\n    }\n\n    try {\n        const { exec } = await import(\u0027child_process\u0027);\n        const { promisify } = await import(\u0027util\u0027);\n        const execAsync = promisify(exec);\n\n        const { stdout, stderr } = await execAsync(command, { timeout: 5000 });\n        return { success: true, data: stdout || stderr };\n    } catch (error: any) {\n        return { success: false, error: error.message ?? String(error) };\n    }\n}\n```\n\nThe published `npm:praisonai@1.7.1` dist file preserves the same behavior:\n\n- `exports.shell = shell`\n- `const firstWord = command.split(/\\s+/)[0]`\n- `if (!safeCommands.includes(firstWord)) ...`\n- `const { stdout, stderr } = await execAsync(command, { timeout: 5000 })`\n\nThis creates a policy/parser differential: PraisonAI checks only the first token, while the shell parses the full string as a script.\n\n### Why This Is Not Intended Behavior\n\nThe helper is explicitly documented in code as a \"safe version\" for read-only commands and contains an allowlist of specific safe commands. The control test proves that non-allowlisted commands are intended to be blocked: direct `printf \u003cmarker\u003e` returns `Command not allowed: printf`.\n\nThe same helper accepting `echo ok; printf \u003cmarker\u003e` is therefore a bypass of the intended safe-command boundary, not merely a permissive command runner.\n\nThis is also consistent with Node\u0027s own guidance for shell execution: `child_process.exec()` runs through a shell, and shell metacharacters can change which commands execute. The fix should make PraisonAI\u0027s authorization boundary match what is actually executed.\n\n## PoV\n\nRun from a local reproduction checkout:\n\n```bash\nnode poc/pov_poc.js 1.7.1\n```\n\nObserved output summary from `evidence/pov-npm-1.7.1.json`:\n\n```json\n{\n  \"package\": \"npm:praisonai\",\n  \"version\": \"1.7.1\",\n  \"installedPackageVersion\": \"1.7.1\",\n  \"commands\": {\n    \"directDisallowedCommand\": \"printf poc.7.1\",\n    \"benignAllowedCommand\": \"echo poc\",\n    \"chainedBypassCommand\": \"echo poc; printf poc.7.1\"\n  },\n  \"controls\": {\n    \"directDisallowedRejected\": true,\n    \"benignAllowedAccepted\": true,\n    \"patchedControlRejectsChainedShell\": true\n  },\n  \"observed\": {\n    \"directDisallowed\": {\n      \"success\": false,\n      \"error\": \"Command not allowed: printf\"\n    },\n    \"chainedBypass\": {\n      \"success\": true,\n      \"data\": \"poc\\npoc.7.1\"\n    }\n  },\n  \"vulnerable\": true\n}\n```\n\nInterpretation:\n\n- Direct `printf \u003cmarker\u003e` is rejected because `printf` is not in `safeCommands`.\n- Benign `echo ...` is accepted.\n- `echo ...; printf \u003cmarker\u003e` is accepted because the first token is `echo`.\n- The shell then executes the non-allowlisted `printf` command.\n- A patched-control validator that rejects shell metacharacters before execution blocks the chained command while still allowing benign `echo`.\n\nThe PoV uses only harmless marker output. It does not read system files, leak environment variables, call external services, or run destructive commands.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nIf lower-trust users, prompts, model output, plugins, or tool input can influence a command string passed to `utility-tools.shell()`, the safe-command allowlist does not restrict execution to the intended read-only commands. An attacker can append arbitrary shell commands after an allowed first token and run them with the PraisonAI process privileges.\n\nConcrete consequences depend on the embedding application and process privileges, but can include:\n\n- reading files and secrets available to the process;\n- modifying files or project state;\n- invoking local tools and package managers;\n- network exfiltration if the host permits egress; and\n- denial of service by running expensive commands.\n\nThis report does not claim that npm PraisonAI exposes this helper as a default unauthenticated network service. It is a library-level safe-command wrapper bypass in a shipped npm subpath.\n\n### Severity\n\nSuggested severity: High.\n\nRationale:\n\n- `AV`: common PraisonAI use is a network-facing application, agent API, or tool integration that accepts user or prompt-controlled tasks.\n- `AC`: a single command string beginning with an allowed command is sufficient.\n- `PR`: conservative scoring assumes the attacker can submit prompts or work items to the application using this helper.\n- `UI`: no further operator interaction is required once the command reaches the helper.\n- `S`: impact is within the PraisonAI-hosting process and its host context.\n- `C/I/A`: arbitrary shell commands can affect confidentiality, integrity, and availability depending on process privileges.\n\nIf maintainers score only direct local library use, `AV:L` may be reasonable. If a deployment exposes this helper through unauthenticated agent/tool endpoints, `PR:N` may be reasonable.\n\n## Suggested Fix\n\nAvoid passing policy-checked strings to a shell.\n\nRecommended:\n\n1. Replace `exec(command)` with `execFile()` or `spawn(command, args, { shell: false })`.\n2. Require callers to pass `{ command, args }` instead of a shell string, or parse the shell string into argv with a shell-aware parser before policy checks.\n3. Apply the allowlist to the exact executable that will be invoked.\n4. Reject shell metacharacters (`;`, `\u0026\u0026`, `||`, `|`, backticks, `$()`, redirects, newlines) if a string API must remain available.\n5. Add regression tests proving that `echo ok` is allowed while `printf marker`, `echo ok; printf marker`, `echo ok \u0026\u0026 printf marker`, and `echo ok | printf marker` are rejected.\n\nIf this helper is not intended to be public, also consider adding a package `exports` map that exposes only supported public API paths.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `npm`\n- Package: `praisonai`\n- Component: TypeScript utility tools helper `src/praisonai-ts/src/tools/utility-tools.ts`\n- Published dist path: `node_modules/praisonai/dist/tools/utility-tools.js`\n- Latest npm package validated: `1.7.1`\n- Current `origin/main` validated: `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n- `src/praisonai-ts/package.json` at `origin/main`: `praisonai` `1.7.1`\n\nSuggested affected range:\n\n```text\nnpm:praisonai \u003e= 1.5.1, \u003c= 1.7.1\n```\n\nAll published npm `1.x` versions were swept locally:\n\n- `1.0.0` through `1.5.0`: `dist/tools/utility-tools.js` was not present in the tested package.\n- `1.5.1`, `1.5.2`, `1.5.3`, `1.5.4`, `1.6.0`, `1.7.0`, and `1.7.1`: vulnerable.\n\nThe npm package has no `exports` map and ships `dist` in its `files` list, so the affected helper is importable as a package subpath:\n\n```js\nconst { shell } = require(\"praisonai/dist/tools/utility-tools.js\");\n```\n\nThe root package entry point does not appear to re-export this helper directly. This report is scoped to the shipped npm subpath and the TypeScript source that generates it.\n\n## Advisory History\n\nVisible PraisonAI advisories and prior submissions were checked. The closest known issues are adjacent but distinct:\n\n- `GHSA-vjv9-7m7j-h833` covers npm TypeScript `SandboxExecutor.allowedCommands` in `src/cli/features/sandbox-executor.ts`, where a caller-supplied allowlist is checked before `spawn(\"sh\", [\"-c\", command])`.\n- This report covers npm TypeScript `utility-tools.shell()` in `src/tools/utility-tools.ts`, where a built-in \"safe read-only commands\" allowlist is checked before `child_process.exec(command)`.\n- Fixing only `SandboxExecutor` leaves this helper unchanged.\n- The public Python/PyPI command-injection advisories cover different packages, files, and execution paths, such as Python `execute_command`, `run_python()`, memory hooks, and subprocess sandbox code.\n\nThis is a sibling-callsite variant of the same mature allowlist/shell-parser class, but it is not the same function, policy surface, affected version range, or shipped import path as the prior npm `SandboxExecutor` advisory.",
  "id": "GHSA-5jv7-2mjm-h6qj",
  "modified": "2026-06-18T14:26:54Z",
  "published": "2026-06-18T14:26:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5jv7-2mjm-h6qj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-14625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-04T12:16:53Z",
    "severity": "LOW"
  },
  "details": "A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tui_gateway/server.py. The manipulation results in protection mechanism failure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-5p65-6hm5-c89p",
  "modified": "2026-07-04T12:30:28Z",
  "published": "2026-07-04T12:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14625"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/3b11589740dcf16b152b0929e1b3d024"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-14625"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/845595"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/376141"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/376141/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-47305"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T19:17:08Z",
    "severity": "HIGH"
  },
  "details": "Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.",
  "id": "GHSA-5q8c-4c69-36xr",
  "modified": "2026-07-14T21:32:16Z",
  "published": "2026-07-14T21:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47305"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}