Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

8384 vulnerabilities reference this CWE, most recent first.

GHSA-MJ46-J682-P569

Vulnerability from github – Published: 2022-05-14 02:52 – Updated: 2022-05-14 02:52
VLAI
Details

XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-2996"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-04-25T20:55:00Z",
    "severity": "HIGH"
  },
  "details": "XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code.  NOTE: this can be leveraged by remote attackers using CVE-2014-2579.",
  "id": "GHSA-mj46-j682-p569",
  "modified": "2022-05-14T02:52:47Z",
  "published": "2022-05-14T02:52:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2996"
    },
    {
      "type": "WEB",
      "url": "https://www.htbridge.com/advisory/HTB23207"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/32790"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/531780/100/0/threaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MJ4V-HP69-27X5

Vulnerability from github – Published: 2025-02-05 21:30 – Updated: 2025-03-14 19:58
VLAI
Summary
Plenti - Code Injection - Denial of Services
Details

Summary

While pushing a file via postLocal method if user add javascript code in file parameter that codes can exe in v8go context.

Details

While posting a file via postLocal, any attacker will add javascript codes to file parameter. That parameter content pass to componentSignature method after some validation. After that componentSignature parameter concat with ssrStr parameter.

image

Last part of compileSvelte function ssrStr parameter executed in v8go engine.

image

This cause to any one who can post a file also can push javascript code and run it. Thanks to v8go we can't use all javascript metod, if there is no any vulnerability in v8go we can't escape sandbox and can't run dangerous command like opening socket etc. But we can create infinite loop and the plenti can't response any request.

After posting a file with name 'layouts/global/test; eval(while(1););var test.svelte' we can see the ssrStr parameter include our javascript codes.

image

Note: Eval usage not must I just want to ensure that it's run javascript commands.

PoC

Request

POST /postlocal HTTP/1.1
Host: localhost:3000
Content-Length: 125
Content-Type: application/json; charset=utf-8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

[{"action":"create","encoding":"text","file":"layouts/global/test; eval(`while(1);`);var test.svelte","contents":"anethole"}]

Video PoC

Curl Request

curl --path-as-is -i -s -k -X $'POST' \
    -H $'Host: localhost:3000' -H $'Content-Length: 125' -H $'Content-Type: application/json; charset=utf-8' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' \
    --data-binary $'[{\"action\":\"create\",\"encoding\":\"text\",\"file\":\"layouts/global/test; eval(`while(1);`);var test.svelte\",\"contents\":\"anethole\"}]' \
    $'http://localhost:3000/postlocal'

Impact

It's a remote code execution vulnerability. Because of the sandbox we can show only Denial of Service impact. Any vulnerability will be exists in v8go that cause to escape sandbox, different impacts can be show.

Note: Plenti is using V8GO and V8GO is using V8 version of 11.1.278. This version released at 25 January 2023. After this date some RCE vulnerabilities founded in V8 like CVE-2024-5830,

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.16"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/plentico/plenti"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-26260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-05T21:30:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nWhile pushing a file via postLocal method if user add javascript code in file parameter that codes can exe in v8go context.\n\n### Details\nWhile posting a file via postLocal, any attacker will add javascript codes to file parameter. That parameter content pass to componentSignature method after some validation. After that componentSignature parameter concat with ssrStr parameter.\n\n\u003cimg width=\"1145\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a08a3fe5-2fbd-4a05-b93c-2ad127e6ee81\" /\u003e\n\nLast part of compileSvelte function ssrStr parameter executed in v8go engine.\n\n\u003cimg width=\"754\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4e622761-3324-48d6-8264-6dd6e09055af\" /\u003e\n\nThis cause to any one who can post a file also can push javascript code and run it. Thanks to v8go we can\u0027t use all javascript metod, if there is no any vulnerability in v8go we can\u0027t escape sandbox and can\u0027t run dangerous command like opening socket etc. But we can create infinite loop and the plenti can\u0027t response any request.\n\nAfter posting a file with name \u0027layouts/global/test; eval(`while(1);`);var test.svelte\u0027 we can see the ssrStr parameter include our javascript codes.\n\n\u003cimg width=\"1023\" alt=\"image\" src=\"https://github.com/user-attachments/assets/369c7820-ff8a-4b9a-9cd3-6b0692f1dcf3\" /\u003e\n\n**Note**: Eval usage not must I just want to ensure that it\u0027s run javascript commands.\n\n### PoC\n**Request**\n```\nPOST /postlocal HTTP/1.1\nHost: localhost:3000\nContent-Length: 125\nContent-Type: application/json; charset=utf-8\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n\n[{\"action\":\"create\",\"encoding\":\"text\",\"file\":\"layouts/global/test; eval(`while(1);`);var test.svelte\",\"contents\":\"anethole\"}]\n```\n**Video**\n![PoC](https://github.com/user-attachments/assets/2aca36a1-6989-4be8-a8d1-3b12960f3e9b)\n\n**Curl Request**\n```\ncurl --path-as-is -i -s -k -X $\u0027POST\u0027 \\\n    -H $\u0027Host: localhost:3000\u0027 -H $\u0027Content-Length: 125\u0027 -H $\u0027Content-Type: application/json; charset=utf-8\u0027 -H $\u0027User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36\u0027 -H $\u0027Accept-Encoding: gzip, deflate, br\u0027 -H $\u0027Connection: keep-alive\u0027 \\\n    --data-binary $\u0027[{\\\"action\\\":\\\"create\\\",\\\"encoding\\\":\\\"text\\\",\\\"file\\\":\\\"layouts/global/test; eval(`while(1);`);var test.svelte\\\",\\\"contents\\\":\\\"anethole\\\"}]\u0027 \\\n    $\u0027http://localhost:3000/postlocal\u0027\n```\n\n### Impact\nIt\u0027s a remote code execution vulnerability. Because of the sandbox we can show only Denial of Service impact. Any vulnerability will be exists in v8go that cause to escape sandbox, different impacts can be show.\n\n**Note:** Plenti is using V8GO and V8GO is using V8 version of 11.1.278. This version released at 25 January 2023. After this date some RCE vulnerabilities founded in V8 like [CVE-2024-5830](https://github.com/advisories/GHSA-fchp-8m28-g68f),",
  "id": "GHSA-mj4v-hp69-27x5",
  "modified": "2025-03-14T19:58:51Z",
  "published": "2025-02-05T21:30:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plentico/plenti/commit/c3e72a9ebbc2a03f4b0f3104becbfc25e390cb8e"
    },
    {
      "type": "WEB",
      "url": "https://ahmetakan.com/2025/02/14/cve-2025-26260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plentico/plenti"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plentico/plenti/releases/tag/v0.7.17"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3454"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3515"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Plenti  - Code Injection - Denial of Services"
}

GHSA-MJ6R-FXQR-4C2F

Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2022-05-13 01:07
VLAI
Details

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2012-1876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-06-12T22:55:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka \"Col Element Remote Code Execution Vulnerability,\" as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.",
  "id": "GHSA-mj6r-fxqr-4c2f",
  "modified": "2022-05-13T01:07:43Z",
  "published": "2022-05-13T01:07:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1876"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15539"
    },
    {
      "type": "WEB",
      "url": "http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars"
    },
    {
      "type": "WEB",
      "url": "http://pwn2own.zerodayinitiative.com/status.html"
    },
    {
      "type": "WEB",
      "url": "http://twitter.com/vupen/statuses/177895844828291073"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA12-164A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.zdnet.com/blog/security/pwn2own-2012-ie-9-hacked-with-two-0day-vulnerabilities/10621"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MJ8G-44PC-GHJG

Vulnerability from github – Published: 2022-05-17 02:40 – Updated: 2022-05-17 02:40
VLAI
Details

Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.

Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-2252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-08T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.",
  "id": "GHSA-mj8g-44pc-ghjg",
  "modified": "2022-05-17T02:40:48Z",
  "published": "2022-05-17T02:40:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2252"
    },
    {
      "type": "WEB",
      "url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MJCQ-9W3F-V5MX

Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-05 18:31
VLAI
Details

Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-11157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:17:22Z",
    "severity": "MODERATE"
  },
  "details": "Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)",
  "id": "GHSA-mjcq-9w3f-v5mx",
  "modified": "2026-06-05T18:31:36Z",
  "published": "2026-06-05T00:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11157"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/501823385"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MJF2-HX35-V8CQ

Vulnerability from github – Published: 2022-05-01 07:30 – Updated: 2022-05-01 07:30
VLAI
Details

PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the aide parameter.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2006-5612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-10-31T01:07:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the aide parameter.",
  "id": "GHSA-mjf2-hx35-v8cq",
  "modified": "2022-05-01T07:30:08Z",
  "published": "2022-05-01T07:30:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5612"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29853"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/3467"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/1795"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/449887/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/20750"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/0943"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MJF8-RRMF-Q848

Vulnerability from github – Published: 2022-04-29 02:58 – Updated: 2025-04-03 04:00
VLAI
Details

Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2004-0637"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-09-02T04:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible.",
  "id": "GHSA-mjf8-rrmf-q848",
  "modified": "2025-04-03T04:00:57Z",
  "published": "2022-04-29T02:58:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0637"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/12409"
    },
    {
      "type": "WEB",
      "url": "http://www.idefense.com/application/poi/display?id=136\u0026type=vulnerabilities\u0026flashstatus=true"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/316206"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/11099"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MJFQ-3QR2-6G84

Vulnerability from github – Published: 2025-05-14 17:35 – Updated: 2025-05-14 17:35
VLAI
Summary
Cosmos EVM Allows Partial Precompile State Writes
Details

Impact

Setting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state.

If executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.

Any evmOS or Cosmos EVM chain using precompiles is affected.

Patches

The vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.

  • evmos/os patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/

For chains using a different file structure, you must manually apply the diff:

In x/evm/statedb.go:

Add the following function:

func (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {
    s.cacheCtx = s.cacheCtx.WithMultiStore(cms)
    s.writeCache = func() {
        // rollback the events to the ones
        // on the snapshot
        s.ctx.EventManager().EmitEvents(events)
        cms.Write()
    }
}

In x/evm/statedb/journal.go:

Replace the Revert function with the following:

func (pc precompileCallChange) Revert(s *StateDB) {
    // rollback multi store from cache ctx to the previous
    // state stored in the snapshot
    s.RevertMultiStore(pc.multiStore, pc.events)
}

In precompiles/common/precompile.go:

Change the function signature in HandleGasError to:

func HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {
...
}

In the HandleGasError function, add the following line in the switch statement in the case storetypes.ErrorOutOfGas: case:

stateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)

Add the following function:

// RunAtomic is used within the Run function of each Precompile implementation.
// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.
// Note: This is only required for stateful precompiles.
func (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {
    bz, err := fn()
    if err != nil {
        // revert to snapshot on error
        stateDB.RevertMultiStore(s.MultiStore, s.Events)
    }
    return bz, err
}

All Precompiles:

Finally, in each precompile, locate the Run function, and wrap each switch statement and return values into p.RunAtomic. For example:

// Run executes the precompiled contract IBC transfer methods defined in the ABI.
func (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {
    ctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)
    if err != nil {
        return nil, err
    }

    // This handles any out of gas errors that may occur during the execution of a precompile tx or query.
    // It avoids panics and returns the out of gas error so the EVM can continue gracefully.
    defer cmn.HandleGasError(ctx, contract, initialGas, &err, stateDB, snapshot)()

        // === WRAP HERE ===
    return p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {
        switch method.Name {
        // TODO Approval transactions => need cosmos-sdk v0.46 & ibc-go v6.2.0
        // Authorization Methods:
        case exampleCase:
            bz, err = p.example(ctx, evm.Origin, stateDB, method, args)
        default:
            return nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)
        }

        if err != nil {
            return nil, err
        }

        cost := ctx.GasMeter().GasConsumed() - initialGas

        if !contract.UseGas(cost) {
            return nil, vm.ErrOutOfGas
        }

        if err := p.AddJournalEntries(stateDB, snapshot); err != nil {
            return nil, err
        }

        return bz, nil
    })
}

Workarounds

There are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.

Testing

A test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.

Severity
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cosmos/evm"
      },
      "versions": [
        "0.1.0"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-14T17:35:54Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nSetting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state. \n\nIf executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.\n\nAny evmOS or Cosmos EVM chain using precompiles is affected.\n\n### Patches\nThe vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.\n\n- [evmos/os](https://github.com/evmos/os) patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/\n\nFor chains using a different file structure, you must manually apply the diff:\n\n### **In `x/evm/statedb.go`:**\n\nAdd the following function:\n```go\nfunc (s *StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {\n\ts.cacheCtx = s.cacheCtx.WithMultiStore(cms)\n\ts.writeCache = func() {\n\t\t// rollback the events to the ones\n\t\t// on the snapshot\n\t\ts.ctx.EventManager().EmitEvents(events)\n\t\tcms.Write()\n\t}\n}\n```\n\n### **In `x/evm/statedb/journal.go`:**\n\nReplace the `Revert` function with the following:\n```go\nfunc (pc precompileCallChange) Revert(s *StateDB) {\n\t// rollback multi store from cache ctx to the previous\n\t// state stored in the snapshot\n\ts.RevertMultiStore(pc.multiStore, pc.events)\n}\n```\n\n### **In `precompiles/common/precompile.go`:**\n\nChange the function signature in `HandleGasError` to:\n```go\nfunc HandleGasError(ctx sdk.Context, contract *vm.Contract, initialGas storetypes.Gas, err *error, stateDB *statedb.StateDB, snapshot snapshot) func() {\n...\n}\n```\n\nIn the `HandleGasError` function, add the following line in the switch statement in the `case storetypes.ErrorOutOfGas:` case:\n```go\nstateDB.RevertMultiStore(snapshot.MultiStore, snapshot.Events)\n```\n\nAdd the following function:\n```go\n// RunAtomic is used within the Run function of each Precompile implementation.\n// It handles rolling back to the provided snapshot if an error is returned from the core precompile logic.\n// Note: This is only required for stateful precompiles.\nfunc (p Precompile) RunAtomic(s snapshot, stateDB *statedb.StateDB, fn func() ([]byte, error)) ([]byte, error) {\n\tbz, err := fn()\n\tif err != nil {\n\t\t// revert to snapshot on error\n\t\tstateDB.RevertMultiStore(s.MultiStore, s.Events)\n\t}\n\treturn bz, err\n}\n```\n\n### **All Precompiles:**\nFinally, in each precompile, locate the `Run` function, and wrap each switch statement and return values into `p.RunAtomic`. For example:\n```go\n// Run executes the precompiled contract IBC transfer methods defined in the ABI.\nfunc (p Precompile) Run(evm *vm.EVM, contract *vm.Contract, readOnly bool) (bz []byte, err error) {\n\tctx, stateDB, snapshot, method, initialGas, args, err := p.RunSetup(evm, contract, readOnly, p.IsTransaction)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// This handles any out of gas errors that may occur during the execution of a precompile tx or query.\n\t// It avoids panics and returns the out of gas error so the EVM can continue gracefully.\n\tdefer cmn.HandleGasError(ctx, contract, initialGas, \u0026err, stateDB, snapshot)()\n\n        // === WRAP HERE ===\n\treturn p.RunAtomic(snapshot, stateDB, func() ([]byte, error) {\n\t\tswitch method.Name {\n\t\t// TODO Approval transactions =\u003e need cosmos-sdk v0.46 \u0026 ibc-go v6.2.0\n\t\t// Authorization Methods:\n\t\tcase exampleCase:\n\t\t\tbz, err = p.example(ctx, evm.Origin, stateDB, method, args)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(cmn.ErrUnknownMethod, method.Name)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tcost := ctx.GasMeter().GasConsumed() - initialGas\n\n\t\tif !contract.UseGas(cost) {\n\t\t\treturn nil, vm.ErrOutOfGas\n\t\t}\n\n\t\tif err := p.AddJournalEntries(stateDB, snapshot); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\treturn bz, nil\n\t})\n}\n```\n\n\n### Workarounds\nThere are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.\n\n### Testing\nA test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.",
  "id": "GHSA-mjfq-3qr2-6g84",
  "modified": "2025-05-14T17:35:54Z",
  "published": "2025-05-14T17:35:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cosmos/evm/security/advisories/GHSA-mjfq-3qr2-6g84"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cosmos/evm/commit/0fff8c144b24effbcb3addd666150ba5989d631c"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cosmos/evm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cosmos EVM Allows Partial Precompile State Writes"
}

GHSA-MJH4-63MF-8XQC

Vulnerability from github – Published: 2022-05-01 23:36 – Updated: 2022-05-01 23:36
VLAI
Details

PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2008-1059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-02-28T19:44:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.",
  "id": "GHSA-mjh4-63mf-8xqc",
  "modified": "2022-05-01T23:36:22Z",
  "published": "2022-05-01T23:36:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1059"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40829"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/5194"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/29099"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3706"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/488734/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/27985"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MJP9-35C3-RJJH

Vulnerability from github – Published: 2022-05-01 02:03 – Updated: 2022-05-01 02:03
VLAI
Details

Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2005-1894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2005-06-09T04:00:00Z",
    "severity": "HIGH"
  },
  "details": "Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.",
  "id": "GHSA-mjp9-35c3-rjjh",
  "modified": "2022-05-01T02:03:09Z",
  "published": "2022-05-01T02:03:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-1894"
    },
    {
      "type": "WEB",
      "url": "http://flatnuke.sourceforge.net/index.php?mod=read\u0026id=1117979256"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/15603"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1014114"
    },
    {
      "type": "WEB",
      "url": "http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2005/0697"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation
Architecture and Design
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation
Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list