Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

8467 vulnerabilities reference this CWE, most recent first.

GHSA-3329-GHMP-JMV5

Vulnerability from github – Published: 2025-12-29 20:04 – Updated: 2025-12-29 20:04
VLAI
Summary
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
Details

Summary

Picklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files.

Details

The attack payload executes in the following steps:

  • First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method
  • Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.

PoC

class RCE:
    def __reduce__(self):
        from numpy.f2py.crackfortran import myeval
        return (myeval, ("os.system('ls')",))

Impact

Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Report by

Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).

Severity
7.4 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-29T20:04:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nPicklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method\n- Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn\u0027t detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.\n\n### PoC\n```\nclass RCE:\n    def __reduce__(self):\n        from numpy.f2py.crackfortran import myeval\n        return (myeval, (\"os.system(\u0027ls\u0027)\",))\n```\n\n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).",
  "id": "GHSA-3329-ghmp-jmv5",
  "modified": "2025-12-29T20:04:09Z",
  "published": "2025-12-29T20:04:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3329-ghmp-jmv5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/pull/53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval"
}

GHSA-333G-RPR4-7HXQ

Vulnerability from github – Published: 2019-08-20 14:29 – Updated: 2023-08-28 21:39
VLAI
Summary
rest-client Gem Contains Malicious Code
Details

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x. Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory. These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.13"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "rest-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.10"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "cron_parser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.13"
            },
            {
              "last_affected": "1.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "cron_parser"
      },
      "versions": [
        "0.1.4"
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "coin_base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "blockchain_wallet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "awesome-bot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "doge-coin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "capistrano-colors"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "bitcoin_vanity"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "coming-soon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "omniauth_amazon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-15224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-08-20T14:27:19Z",
    "nvd_published_at": "2019-08-19T23:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.\nUsers of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.\nAdditionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.\nThese include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.",
  "id": "GHSA-333g-rpr4-7hxq",
  "modified": "2023-08-28T21:39:41Z",
  "published": "2019-08-20T14:29:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15224"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rest-client/rest-client/issues/713"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubygems/rubygems.org/issues/2097"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/blockchain_wallet/CVE-2019-15224.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/coin_base/CVE-2019-15224.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doge-coin/CVE-2019-15224.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lita_coin/CVE-2019-15224.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth_amazon/CVE-2019-15224.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rest-client/CVE-2019-15224.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rest-client Gem Contains Malicious Code"
}

GHSA-3345-GFQQ-Q77J

Vulnerability from github – Published: 2022-05-14 02:58 – Updated: 2022-05-14 02:58
VLAI
Details

GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-14579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-24T14:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the \"Database Information\" \"Table prefix\" form field, or obtain sensitive information via a direct request for install/install.sql.",
  "id": "GHSA-3345-gfqq-q77j",
  "modified": "2022-05-14T02:58:50Z",
  "published": "2022-05-14T02:58:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14579"
    },
    {
      "type": "WEB",
      "url": "https://github.com/havysec/Useful_Code/blob/master/mycve/001.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3354-F842-X834

Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-14 00:00
VLAI
Details

Microsoft OLE DB Provider for SQL Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34731, CVE-2022-34733, CVE-2022-35834, CVE-2022-35835, CVE-2022-35840.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-35836"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-13T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft OLE DB Provider for SQL Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34731, CVE-2022-34733, CVE-2022-35834, CVE-2022-35835, CVE-2022-35840.",
  "id": "GHSA-3354-f842-x834",
  "modified": "2022-09-14T00:00:44Z",
  "published": "2022-09-14T00:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35836"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35836"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-35836"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-335V-RQWJ-XJ3W

Vulnerability from github – Published: 2022-05-17 01:00 – Updated: 2022-05-17 01:00
VLAI
Details

YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-3232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-09-29T00:55:00Z",
    "severity": "HIGH"
  },
  "details": "YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.",
  "id": "GHSA-335v-rqwj-xj3w",
  "modified": "2022-05-17T01:00:33Z",
  "published": "2022-05-17T01:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3232"
    },
    {
      "type": "WEB",
      "url": "https://bugs.webkit.org/show_bug.cgi?id=61585"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=653672"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14408"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/46315"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/49055"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT4981"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT4999"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT5000"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT5001"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:141"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:142"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2011/mfsa2011-42.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-3367-M896-H674

Vulnerability from github – Published: 2022-04-30 18:21 – Updated: 2022-04-30 18:21
VLAI
Details

csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2002-1750"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2002-12-31T05:00:00Z",
    "severity": "MODERATE"
  },
  "details": "csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.",
  "id": "GHSA-3367-m896-h674",
  "modified": "2022-04-30T18:21:50Z",
  "published": "2022-04-30T18:21:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1750"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8636"
    },
    {
      "type": "WEB",
      "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2002/04/msg00106.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/4448"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-337C-3RCH-Q35J

Vulnerability from github – Published: 2022-05-24 17:24 – Updated: 2024-01-11 16:50
VLAI
Summary
Magento php object injection vulnerability
Details

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution. A patch SUPEE-11346 is available at Magento Open Source Download Page > Release Archive Tab > Magento Open Source Patches - 1.x Section

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.9.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-9664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-11T16:50:57Z",
    "nvd_published_at": "2020-07-22T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.\nA patch SUPEE-11346 is available at [Magento Open Source Download Page](https://github.com/m-a-org/magento-patches) \u003e Release Archive Tab \u003e Magento Open Source Patches - 1.x Section",
  "id": "GHSA-337c-3rch-q35j",
  "modified": "2024-01-11T16:50:57Z",
  "published": "2022-05-24T17:24:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9664"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/magento/apsb20-41.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Magento php object injection vulnerability"
}

GHSA-3388-VWWC-36QR

Vulnerability from github – Published: 2025-11-06 18:32 – Updated: 2026-01-20 15:31
VLAI
Details

Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-47588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-06T16:15:51Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through \u003c= 4.5.9.",
  "id": "GHSA-3388-vwwc-36qr",
  "modified": "2026-01-20T15:31:46Z",
  "published": "2025-11-06T18:32:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47588"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/aco-woo-dynamic-pricing/vulnerability/wordpress-dynamic-pricing-with-discount-rules-for-woocommerce-plugin-4-5-9-arbitrary-code-execution-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/aco-woo-dynamic-pricing/vulnerability/wordpress-dynamic-pricing-with-discount-rules-for-woocommerce-plugin-4-5-9-arbitrary-code-execution-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/aco-woo-dynamic-pricing/vulnerability/wordpress-dynamic-pricing-with-discount-rules-for-woocommerce-plugin-4-5-9-arbitrary-code-execution-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-338P-8VW7-XGW3

Vulnerability from github – Published: 2022-05-17 05:32 – Updated: 2025-04-11 03:53
VLAI
Details

RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-4248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-11-24T11:55:00Z",
    "severity": "HIGH"
  },
  "details": "RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file.",
  "id": "GHSA-338p-8vw7-xgw3",
  "modified": "2025-04-11T03:53:01Z",
  "published": "2022-05-17T05:32:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4248"
    },
    {
      "type": "WEB",
      "url": "http://service.real.com/realplayer/security/11182011_player/en"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-339M-4QW5-J2G3

Vulnerability from github – Published: 2026-01-21 16:38 – Updated: 2026-01-22 15:43
VLAI
Summary
Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
Details

A critical deserialization vulnerability exists in Tendenci Helpdesk module (NOTE, by default, Helpdesk is NOT enabled), affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution (RCE) by an authenticated user with staff security level due to using Python's pickle module on the helpdesk /reports/. The damage is contained to the user that your Tendenci application runs.

Key Finding: The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads().

Permission Scoping: The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions.

Vulnerability Details

Affected Version

  • Version: Tendenci 15.3.11 and earlier (all versions since incomplete CVE-2020-14942 patch)
  • Component: tendenci/apps/helpdesk/views/staff.py

Related CVE

  • CVE-2020-14942: Original pickle deserialization vulnerability (partially patched)
  • GitHub Advisory: GHSA-jqmc-fxxp-r589
  • Original Issue: https://github.com/tendenci/tendenci/issues/867

Tendenci User Role Hierarchy

Level Role Description
0 is_superuser Highest privilege - full Django admin
1 is_staff user with Staff security level - can access helpdesk module
2 Authenticated User Basic user access
3 Anonymous User Public read-only access

is_staff is a commonly assigned role (by a superuser) for helpdesk operators who manage support tickets - not system administrators.

Code Comparison (Patched vs Vulnerable)

Function Line Deserialization Status
ticket_list() 763 simplejson.loads() ✅ SAFE
run_report() 1062 pickle.loads() ❌ VULNERABLE

Why This Qualifies for CVE Assignment

This vulnerability represents an incomplete patch bypass for CVE-2020-14942 with a clear exploitation path. The flaw allows a malicious user with Staff security level to achieve Remote Code Execution via Python's pickle.loads. Though the damage is contained to the user that your Tendenci application runs.

Remediation

Update Tendenci to the latest version (v15.3.12 as of now) immediately if you have Helpdesk enabled. Note that Helpdesk is not enabled by default. All of our hosted sites have been patched, although none of our client sites have the Helpdesk enabled.

References

  • Tendenci GitHub: https://github.com/tendenci/tendenci
  • CVE-2020-14942: https://nvd.nist.gov/vuln/detail/CVE-2020-14942
  • GitHub Advisory: https://github.com/advisories/GHSA-jqmc-fxxp-r589
  • Original Issue: https://github.com/tendenci/tendenci/issues/867
  • CWE-502: https://cwe.mitre.org/data/definitions/502.html
  • Python Pickle Security: https://docs.python.org/3/library/pickle.html#restricting-globals
Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tendenci"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T16:38:15Z",
    "nvd_published_at": "2026-01-22T01:15:52Z",
    "severity": "MODERATE"
  },
  "details": "A critical deserialization vulnerability exists in Tendenci Helpdesk module (NOTE, by default, Helpdesk is NOT enabled), affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution (RCE) by an authenticated user with staff security level due to using Python\u0027s pickle module on the helpdesk /reports/. The damage is contained to the user that your Tendenci application runs.\n\n**Key Finding:** The original CVE-2020-14942 was incompletely patched. While `ticket_list()` was fixed to use safe JSON deserialization, the `run_report()` function still uses unsafe `pickle.loads()`.\n\n**Permission Scoping:** The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions.\n\n## Vulnerability Details\n\n### Affected Version\n- **Version:** Tendenci 15.3.11 and earlier (all versions since incomplete CVE-2020-14942 patch)\n- **Component:** `tendenci/apps/helpdesk/views/staff.py`\n\n### Related CVE\n- **CVE-2020-14942:** Original pickle deserialization vulnerability (partially patched)\n- **GitHub Advisory:** GHSA-jqmc-fxxp-r589\n- **Original Issue:** https://github.com/tendenci/tendenci/issues/867\n\n### Tendenci User Role Hierarchy\n\n| Level | Role | Description |\n|-------|------|-------------|\n| 0 | `is_superuser` | Highest privilege - full Django admin |\n| 1 | `is_staff` | user with Staff security level - can access helpdesk module |\n| 2 | Authenticated User | Basic user access |\n| 3 | Anonymous User | Public read-only access |\n\n`is_staff` is a commonly assigned role (by a superuser) for helpdesk operators who manage support tickets - not system administrators. \n\n\n### Code Comparison (Patched vs Vulnerable)\n\n| Function | Line | Deserialization | Status |\n|----------|------|-----------------|--------|\n| `ticket_list()` | 763 | `simplejson.loads()` | \u2705 SAFE |\n| `run_report()` | 1062 | `pickle.loads()` | \u274c VULNERABLE |\n\n## Why This Qualifies for CVE Assignment\n\nThis vulnerability represents an **incomplete patch bypass** for CVE-2020-14942 with a clear exploitation path. The flaw allows a malicious user with Staff security level to achieve Remote Code Execution via Python\u0027s pickle.loads. Though the damage is contained to the user that your Tendenci application runs. \n\n## Remediation\n\nUpdate Tendenci to the latest version (v15.3.12 as of now) immediately if you have Helpdesk enabled. Note that Helpdesk is not enabled by default. All of our hosted sites have been patched, although **none** of our client sites have the Helpdesk enabled.\n\n\n## References\n\n- Tendenci GitHub: https://github.com/tendenci/tendenci\n- CVE-2020-14942: https://nvd.nist.gov/vuln/detail/CVE-2020-14942\n- GitHub Advisory: https://github.com/advisories/GHSA-jqmc-fxxp-r589\n- Original Issue: https://github.com/tendenci/tendenci/issues/867\n- CWE-502: https://cwe.mitre.org/data/definitions/502.html\n- Python Pickle Security: https://docs.python.org/3/library/pickle.html#restricting-globals",
  "id": "GHSA-339m-4qw5-j2g3",
  "modified": "2026-01-22T15:43:00Z",
  "published": "2026-01-21T16:38:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14942"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendenci/tendenci/issues/867"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/pickle.html#restricting-globals"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-jqmc-fxxp-r589"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tendenci/tendenci"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization"
}
Mitigation
Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation
Architecture and Design
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation
Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list