CWE-88

{
  "affected": [],
  "aliases": [
    "CVE-2018-19518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-25T10:29:00Z",
    "severity": "HIGH"
  },
  "details": "University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a \"-oProxyCommand\" argument.",
  "id": "GHSA-5qmr-54g6-4256",
  "modified": "2022-05-13T01:02:14Z",
  "published": "2022-05-13T01:02:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19518"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2018/11/22/3"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45914"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4353"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4160-1"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20181221-0004"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202003-57"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00031.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php"
    },
    {
      "type": "WEB",
      "url": "https://git.php.net/?p=php-src.git;a=commit;h=e5bfea64c81ae34816479bb05d17cdffe45adddb"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=77160"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=77153"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=76428"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/913836"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/913835"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/913775"
    },
    {
      "type": "WEB",
      "url": "https://antichat.com/threads/463395/#post-4254681"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106018"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1042157"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-68766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T15:16:20Z",
    "severity": "HIGH"
  },
  "details": "hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.",
  "id": "GHSA-5qq7-x27p-hfq4",
  "modified": "2026-08-22T15:31:04Z",
  "published": "2026-08-22T15:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashcat/hashcat/issues/4738"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashcat/hashcat"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashcat/hashcat/blob/v7.1.2/src/restore.c#L365-L369"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/hashcat-through-arbitrary-file-write-via-restore-file-option-injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T22:15:53Z",
    "nvd_published_at": "2026-03-18T02:16:20Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA Windows `system.run` approval-integrity mismatch in the `cmd.exe /c` path could allow trailing arguments to execute while approval/audit text reflected only a benign command string.\n\nThis requires an authenticated operator context using the approvals flow and a trusted Windows node.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published vulnerable version (as of 2026-02-21): `2026.2.19-2`\n- Vulnerable range: `\u003c=2026.2.19-2`\n- Patched version (planned next release): `2026.2.21`\n\n### Attack Scenario\n1. An authenticated operator approval is created for a benign command text (for example, `echo`).\n2. A `system.run` request uses `cmd.exe /c` with extra trailing arguments.\n3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node.\n\n### Impact\n- Local command execution on the trusted Windows node process account.\n- Approval/audit command text integrity mismatch.\n\n### Fix\n- Canonicalize the full command tail after `cmd.exe /c`.\n- Reuse one shared command canonicalization/validation path for validation, approval matching, and execution/audit text.\n- Add regression coverage for trailing-argument smuggling and approval binding.\n\n### Fix Commit(s)\n- `6007941f04df1edcca679dd6c95949744fdbd4df`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is live, this advisory can be published directly.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-5v6x-rfc3-7qfr",
  "modified": "2026-03-19T21:20:03Z",
  "published": "2026-03-02T22:15:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5v6x-rfc3-7qfr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/6007941f04df1edcca679dd6c95949744fdbd4df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmd-exe-c-trailing-arguments-in-system-run"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@cyclonedx/cdxgen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T19:47:24Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3.\n\nWhen cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with `shell: true`. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path.\n\nThis could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context.\n\nThe issue affected both the CLI and server mode. The issue is patched in `12.4.3`.\n\n## Affected asset\n\n- Project: cdxgen\n- Tested version: 12.4.1\n- Mode tested: server mode\n- Endpoint: `POST /sbom`\n- Scanner path: Java / Maven project scanning\n\n## Patch\n\nVersion 12.4.3 includes hardening for this issue with PR #4059 \n\nThe patch adds multiple mitigations:\n\n- Maven command invocations no longer use unconditional shell execution on POSIX platforms.\n- Bazel command invocation was similarly changed away from unconditional shell execution.\n- Windows compatibility is preserved using `shell: isWin` where needed.\n- `safeSpawnSync` now blocks `shell: true` invocations when the command or direct argument values contain shell metacharacters.\n- cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope.\n\n## Workarounds\n\nThe recommended remediation is to upgrade to 12.4.3 or later.\n\nIf immediate upgrade is not possible:\n\n- Do not run cdxgen server mode on untrusted networks.\n- Do not expose POST /sbom to unauthenticated or untrusted clients.\n- Avoid scanning untrusted Java/Maven repositories.\n- Run cdxgen inside a locked-down container or sandbox.\n- Remove sensitive environment variables from the cdxgen process environment.\n- Use least-privilege filesystem mounts.\n- Restrict outbound network access where possible.\n\nUse cdxgen secure/dry-run modes where suitable to inspect planned operations before performing scans.\nConfigure host and command allowlists where applicable, such as:\n\n- CDXGEN_SERVER_ALLOWED_HOSTS\n- CDXGEN_GIT_ALLOWED_HOSTS\n- CDXGEN_ALLOWED_COMMANDS\n- CDXGEN_SECURE_MODE=true\n\nThese mitigations reduce exposure but do not fully address the vulnerable command construction in affected versions.\n\n## Threat model clarification\n\nThe mitigation added in 12.4.3 applies to the cdxgen process boundary. Specifically, cdxgen now hardens command, option, and path values that cdxgen itself passes to external processes through safeSpawnSync.\n\nThis does not mean cdxgen sanitizes every nested path, module name, generated path, or project-controlled value that an external build tool later discovers and interprets inside its own process. Once cdxgen safely invokes Maven, Gradle, Bazel, SBT, or another build tool, that tool\u2019s internal behavior remains a separate trust boundary.\n\n### In scope for this fix:\n\n- command and argument values passed directly by cdxgen to child processes;\n- cdxgen\u2019s own use of shell: true;\n- Maven/Bazel command invocation paths controlled by cdxgen.\n\n### Out of scope for this specific mitigation:\n- arbitrary nested paths later discovered by Maven itself;\n- Maven plugin behavior;\n- Maven lifecycle hooks;\n- build-tool-specific interpretation of project files after cdxgen has launched the tool.\n\nThis residual risk is documented in the cdxgen threat model and is why untrusted project scans should still be run in sandboxed, least-privileged environments.\n\n## Detection\n\nPossible indicators of exploitation or probing include:\n\n- Maven module directories containing shell metacharacters such as:\n\n```\n;\n\u0026\n|\n\u003c\n\u003e\n$\nbackticks\nnewlines\n```\n\n- Logs showing settings.xml or pom.xml discovered in suspicious paths.\n- Unexpected files created outside the scanned repository during a Java/Maven scan.\n- Unexpected child process behavior during cdxgen server scans.\n- cdxgen server receiving POST /sbom requests for attacker-controlled Git URLs.\n\nExample suspicious path pattern:\n\n```\nevil;cd${IFS}..;cd${IFS}..;printf${IFS}...\u003e...;#\n```\n\n## Credits\n\nReported-By: @aleff-github \n\n## Resources\n\n- Patch PR - https://github.com/cdxgen/cdxgen/pull/4059",
  "id": "GHSA-5vwr-qchf-q4pf",
  "modified": "2026-06-26T19:47:24Z",
  "published": "2026-06-26T19:47:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cdxgen/cdxgen/security/advisories/GHSA-5vwr-qchf-q4pf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cdxgen/cdxgen/pull/4059"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cdxgen/cdxgen"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-14591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-29T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.",
  "id": "GHSA-5w4x-5vvq-236j",
  "modified": "2022-05-17T00:12:24Z",
  "published": "2022-05-17T00:12:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14591"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/x/plcGO"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102194"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-3015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-06-14T15:06:00Z",
    "severity": "HIGH"
  },
  "details": "Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.",
  "id": "GHSA-5wfx-x267-4p7r",
  "modified": "2022-05-01T07:04:59Z",
  "published": "2022-05-01T07:04:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-3015"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27075"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0196.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046810.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/20575"
    },
    {
      "type": "WEB",
      "url": "http://winscp.net/eng/docs/history#3.8.2"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/912588"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/18384"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/2289"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.58"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "GitPython"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-78678"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T18:41:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n`Repo.blame()` / `Repo.blame_incremental()` guard forwarded revision options against `unsafe_git_revision_options`, but that denylist only contains the file-WRITE options `--output`/`-o`. `git blame` also honors `--contents \u003cfile\u003e` and `-S \u003cfile\u003e`, which cause the file\u0027s lines to be echoed into the blame result \u2014 an arbitrary file READ. Neither option is in the denylist, so a caller-influenced revision value of `--contents=\u003cpath\u003e` passes the guard and leaks file contents. This is a distinct sink-option and impact class (READ) from GHSA-956x-8gvw-wg5v (which addressed the blame `--output` WRITE), directly analogous to GHSA-539m-9xh6-q6rr (archive READ gap accepted separately from the archive write/exec advisory).\n\n## Root Cause\n`unsafe_git_revision_options = [\"--output\",\"-o\"]` (`git/repo/base.py:188`). The `rev` string is passed to `_option_candidates([rev], kwargs)` and placed BEFORE the `--` separator (base.py:841). The canonical name of `--contents=...` is `contents`, which is not on the denylist, so no `UnsafeOptionError` is raised. The trailing `--` protects only the pathspec, not the option before the revision.\n\n## Impact\nArbitrary local file read at the privileges of the host process; the file\u0027s line contents appear in the blame result returned to the caller. Pure VALUE control (the caller forwards a user-influenced revision string). Default `allow_unsafe_options=False`.\n\n## Proof of Concept\n```python\nresult = repo.blame(\"--contents=/etc/passwd\", \"a.txt\")\n# result rows carry the victim file\u0027s line text\n```\n\n## Attack Chain\n1. Entry: app calls `repo.blame(rev, file)` with attacker `rev=\"--contents=/etc/passwd\"` (or kwarg `contents=\"/etc/passwd\"`, or `-S`).\n2. Check: `Git.check_unsafe_options(_option_candidates([rev,...], kwargs), unsafe_git_revision_options)` @ base.py:841. Guard: denylist = `[\"--output\",\"-o\"]` only. Bypass proof: canonical name `contents` \u2209 denylist \u2192 no error.\n3. Sink: `self.git.blame(rev, \"--\", file, p=True, ...)`. argv (observed): `[\u0027git\u0027,\u0027blame\u0027,\u0027-p\u0027,\u0027--contents=\u003csecret\u003e\u0027,\u0027HEAD\u0027,\u0027--\u0027,\u0027a.txt\u0027]`.\n4. Impact: blame result rows carry the victim file\u0027s line text.\n\n## Bypass Evidence\nIndependently reproduced (independent test harness, default `allow_unsafe_options=False`): `blame(\u0027--contents=\u003csecret\u003e\u0027,\u0027a.txt\u0027)` \u2192 guard PASSED; result rows = `[\u0027GATE_SECRET_LINE_A\u0027,\u0027GATE_SECRET_LINE_B\u0027]`. Control: `blame(\u0027--output=\u2026\u0027)` still BLOCKED (guard active on this path). `-S` kwarg argv also reaches git unguarded.\n\n## Affected Versions\n`GitPython \u003c= 3.1.58` (denylist present verbatim on the latest release tag).\n\n## Suggested Fix\nPrefer an allowlist of blame options; at minimum add `--contents`/`-S` (and any other path-taking blame options) to `unsafe_git_revision_options`, and make the membership rule \"the option takes a filesystem path\" rather than \"the option writes output\".\n\n---\nReported by **zx (Jace)** \u2014 GitHub: @manus-use",
  "id": "GHSA-5xxx-qhh7-9287",
  "modified": "2026-09-08T18:41:31Z",
  "published": "2026-09-08T18:41:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78678"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gitpython-developers/GitPython"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3788.yaml"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-10992"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-11T22:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523.",
  "id": "GHSA-62j8-9w4c-7rfw",
  "modified": "2022-05-13T01:18:51Z",
  "published": "2022-05-13T01:18:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10992"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/898373"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-86060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-05T20:17:18Z",
    "severity": "CRITICAL"
  },
  "details": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask\u00a0to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions:\u00a06.49.21 (Long-term),\u00a07.23.4 (Long-term)\u00a0and\u00a07.24.2 (Stable)",
  "id": "GHSA-6425-cjxv-52gp",
  "modified": "2026-09-11T15:32:27Z",
  "published": "2026-09-05T21:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86060"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited"
    },
    {
      "type": "WEB",
      "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802"
    },
    {
      "type": "WEB",
      "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"
    },
    {
      "type": "WEB",
      "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"
    },
    {
      "type": "WEB",
      "url": "https://mikrotik.com/supportsec/september-2026-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/Masterminds/vcs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-01T14:05:33Z",
    "nvd_published_at": "2022-04-01T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "URLs and local file paths passed to the Mercurial (hg) APIs that are specially crafted can contain commands which are executed by Mercurial if it is installed on the host operating system. The `vcs` package uses the underly version control system, in this case `hg`, to implement the needed functionality. When `hg` is executed, argument strings are passed to `hg` in a way that additional flags can be set. The additional flags can be used to perform a command injection. Other version control systems with an implemented interface may also be vulnerable. The issue has been fixed in version 1.13.2. A work around is to sanitize data passed to the `vcs` package APIs to ensure it does not contain commands or unexpected data. This is important for user input data that is passed directly to the package APIs.",
  "id": "GHSA-6635-c626-vj4r",
  "modified": "2024-05-20T21:29:38Z",
  "published": "2022-04-01T14:05:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Masterminds/vcs/security/advisories/GHSA-6635-c626-vj4r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21235"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Masterminds/vcs/pull/105"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Masterminds/vcs/commit/922a5122330ea8fbe56352a0172ddb6bf019cd22"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Masterminds/vcs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Masterminds/vcs/releases/tag/v1.13.2"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Command Injection Vulnerability with Mercurial in VCS"
}