CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8381 vulnerabilities reference this CWE, most recent first.
GHSA-6JCC-Q6WJ-GHJV
Vulnerability from github – Published: 2022-05-01 07:03 – Updated: 2022-05-01 07:03PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php.
{
"affected": [],
"aliases": [
"CVE-2006-2852"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-06-06T20:06:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php.",
"id": "GHSA-6jcc-q6wj-ghjv",
"modified": "2022-05-01T07:03:16Z",
"published": "2022-05-01T07:03:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2852"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26918"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20463"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/1045"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1016220"
},
{
"type": "WEB",
"url": "http://www.majorsecurity.de/advisory/major_rls7.txt"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/25981"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/25983"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/displayvuln.php?osvdb_id=25982"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/435870/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/18258"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/2141"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6JFX-5CXR-8QXW
Vulnerability from github – Published: 2022-09-29 00:00 – Updated: 2025-05-21 15:30TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
{
"affected": [],
"aliases": [
"CVE-2022-40486"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-28T13:15:00Z",
"severity": "HIGH"
},
"details": "TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.",
"id": "GHSA-6jfx-5cxr-8qxw",
"modified": "2025-05-21T15:30:26Z",
"published": "2022-09-29T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40486"
},
{
"type": "WEB",
"url": "https://github.com/gscamelo/TP-Link-Archer-AX10-V1/blob/main/README.md"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/br/home-networking/wifi-router/archer-ax10"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/br/support/download/archer-ax10/v1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6JJ2-JRR7-FMXQ
Vulnerability from github – Published: 2022-08-06 00:00 – Updated: 2022-08-08 00:00Improper Input Validation in GitHub repository hestiacp/hestiacp prior to 1.6.6.
{
"affected": [],
"aliases": [
"CVE-2022-2636"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-05T10:15:00Z",
"severity": "HIGH"
},
"details": "Improper Input Validation in GitHub repository hestiacp/hestiacp prior to 1.6.6.",
"id": "GHSA-6jj2-jrr7-fmxq",
"modified": "2022-08-08T00:00:34Z",
"published": "2022-08-06T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2636"
},
{
"type": "WEB",
"url": "https://github.com/hestiacp/hestiacp/commit/b178b9719bb2c98cf8a6db70065086f596afad81"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/357c0390-631c-4684-b6e1-a6d8b2453d66"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6JJ6-GM7P-FCVV
Vulnerability from github – Published: 2024-07-01 20:34 – Updated: 2025-10-22 19:25Summary
Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.
Details
The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances.
PoC
No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests.
Impact
This vulnerability can lead to executing arbitrary code.
Workaround
A workaround exists by removing the gt-complex-x.y.jar file from the GeoServer where x.y is the GeoTools version (e.g., gt-complex-31.1.jar if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed by an extension you are using:
Mitigation for geoserver.war deploy:
- Stop the application server
- Unzip
geoserver.warinto a directory - Locate the file
WEB-INF/lib/gt-complex-x.y.jarand remove - Zip the directory into a new
geoserver.war - Restart the application server
Mitigation for GeoServer binary:
- Stop Jetty
- Locate the file
webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jarand remove - Restart Jetty
The following extensions and community modules are known to have a direct dependency on gt-complex jar and are not expected function properly without it. This is not comprehensive list and additional GeoServer functionality may be dependent on the availability of gt-complex jar:
* Extensions: Application Schema, Catalog Services for the Web, MongoDB Data Store
* Community Modules: Features-Templating, OGC API Modules, Smart Data Loader, SOLR Data Store
Mitigation available for prior releases patching three jars in your existing install:
- Patched
gt-app-schema,gt-complexandgt-xsd-corejars may be downloaded for GeoServer: 2.25.1, 2.24.3, 2.24.2, 2.23.2, 2.22.2, 2.21.5, 2.21.4,2.20.7, 2.20.4, 2.19.2, 2.18.0.
As example the 2.25.1 page links to geoserver-2.25.1-patches.zip download on source forge.
-
Unzip the
geoserver-x.y.z-patches.zipwhich contains three jars that have been patched to configurecommons-jxpathwith an empty function list prior to use. These files are drop-in replacements with identical file names to those they are replacing. -
Follow the instructions above to locate
WEB-INF/libfolder and replace the existinggt-app-schema,gt-complexandgt-xsd-corejars with those supplied by the patch.
References
https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w https://osgeo-org.atlassian.net/browse/GEOT-7587 https://github.com/geotools/geotools/pull/4797 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver.web:gs-web-app"
},
"ranges": [
{
"events": [
{
"introduced": "2.24.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "2.24.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wms"
},
"ranges": [
{
"events": [
{
"introduced": "2.24.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver.web:gs-web-app"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wms"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver.web:gs-web-app"
},
"ranges": [
{
"events": [
{
"introduced": "2.23.0"
},
{
"fixed": "2.23.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "2.23.0"
},
{
"fixed": "2.23.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wms"
},
"ranges": [
{
"events": [
{
"introduced": "2.23.0"
},
{
"fixed": "2.23.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver.web:gs-web-app"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-36401"
],
"database_specific": {
"cwe_ids": [
"CWE-94",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-01T20:34:50Z",
"nvd_published_at": "2024-07-01T16:15:04Z",
"severity": "CRITICAL"
},
"details": "### Summary\nMultiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n\n### Details\nThe GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances.\n\n### PoC\nNo public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests.\n\n### Impact\nThis vulnerability can lead to executing arbitrary code.\n\n### Workaround\n\nA workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed by an extension you are using:\n\nMitigation for `geoserver.war` deploy:\n\n1. Stop the application server\n2. Unzip `geoserver.war` into a directory\n3. Locate the file `WEB-INF/lib/gt-complex-x.y.jar` and remove\n4. Zip the directory into a new `geoserver.war`\n5. Restart the application server\n\nMitigation for GeoServer binary:\n\n1. Stop Jetty\n2. Locate the file `webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jar` and remove\n3. Restart Jetty\n\nThe following extensions and community modules are known to have a direct dependency on `gt-complex` jar and are not expected function properly without it. This is not comprehensive list and additional GeoServer functionality may be dependent on the availability of `gt-complex` jar:\n* Extensions: Application Schema, Catalog Services for the Web, MongoDB Data Store\n* Community Modules: Features-Templating, OGC API Modules, Smart Data Loader, SOLR Data Store\n\nMitigation available for prior releases patching three jars in your existing install:\n\n1. Patched `gt-app-schema`, `gt-complex` and `gt-xsd-core` jars may be downloaded for GeoServer: [2.25.1](https://sourceforge.net/projects/geoserver/files/GeoServer/2.25.1/geoserver-2.25.1-patches.zip/download), [2.24.3](https://sourceforge.net/projects/geoserver/files/GeoServer/2.24.3/geoserver-2.24.3-patches.zip/download), [2.24.2](https://sourceforge.net/projects/geoserver/files/GeoServer/2.24.2/geoserver-2.24.2-patches.zip/download), [2.23.2](https://sourceforge.net/projects/geoserver/files/GeoServer/2.23.2/geoserver-2.23.2-patches.zip/download), [2.22.2](https://sourceforge.net/projects/geoserver/files/GeoServer/2.22.2/geoserver-2.22.2-patches.zip/download), [2.21.5](https://sourceforge.net/projects/geoserver/files/GeoServer/2.21.5/geoserver-2.21.5-patches.zip/download), [2.21.4](https://sourceforge.net/projects/geoserver/files/GeoServer/2.21.4/geoserver-2.21.4-patches.zip/download),[2.20.7](https://sourceforge.net/projects/geoserver/files/GeoServer/2.20.7/geoserver-2.20.7-patches.zip/download), [2.20.4](https://sourceforge.net/projects/geoserver/files/GeoServer/2.20.4/geoserver-2.20.4-patches.zip/download), [2.19.2](https://sourceforge.net/projects/geoserver/files/GeoServer/2.19.2/geoserver-2.19.2-patches.zip/download), [2.18.0](https://sourceforge.net/projects/geoserver/files/GeoServer/2.18.0/geoserver-2.18.0-patches.zip/download).\n \n As example the 2.25.1 page links to [geoserver-2.25.1-patches.zip](https://sourceforge.net/projects/geoserver/files/GeoServer/2.25.1/geoserver-2.25.1-patches.zip/download) download on source forge.\n\n2. Unzip the `geoserver-x.y.z-patches.zip` which contains three jars that have been patched to configure `commons-jxpath` with an empty function list prior to use. These files are drop-in replacements with identical file names to those they are replacing.\n\n3. Follow the instructions above to locate `WEB-INF/lib` folder and replace the existing `gt-app-schema`, `gt-complex` and `gt-xsd-core` jars with those supplied by the patch.\n\n### References\nhttps://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w\nhttps://osgeo-org.atlassian.net/browse/GEOT-7587\nhttps://github.com/geotools/geotools/pull/4797\nhttps://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852",
"id": "GHSA-6jj6-gm7p-fcvv",
"modified": "2025-10-22T19:25:52Z",
"published": "2024-07-01T20:34:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv"
},
{
"type": "WEB",
"url": "https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36401"
},
{
"type": "WEB",
"url": "https://github.com/geotools/geotools/pull/4797"
},
{
"type": "WEB",
"url": "https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852"
},
{
"type": "PACKAGE",
"url": "https://github.com/geoserver/geoserver"
},
{
"type": "WEB",
"url": "https://osgeo-org.atlassian.net/browse/GEOT-7587"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A",
"type": "CVSS_V4"
}
],
"summary": "Remote Code Execution (RCE) vulnerability in geoserver"
}
GHSA-6JQH-X2V6-Q5JQ
Vulnerability from github – Published: 2024-07-21 09:30 – Updated: 2024-07-21 09:30A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272069 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-6947"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-21T09:15:03Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272069 was assigned to this vulnerability.",
"id": "GHSA-6jqh-x2v6-q5jq",
"modified": "2024-07-21T09:30:33Z",
"published": "2024-07-21T09:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6947"
},
{
"type": "WEB",
"url": "https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.272069"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.272069"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.376785"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6JR7-99PF-8VGF
Vulnerability from github – Published: 2026-02-02 20:19 – Updated: 2026-02-02 20:19Impact
When TechDocs is configured with runIn: local, a malicious actor who can submit or modify a repository's mkdocs.yml file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration.
Patches
Upgrade to @backstage/plugin-techdocs-node version 1.13.11, 1.14.1 or later.
The fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (including hooks) are now removed from mkdocs.yml before running the generator, with a warning logged to indicate which keys were removed.
Note: Users of @techdocs/cli should also upgrade to the latest version, which includes the fixed @backstage/plugin-techdocs-node dependency.
Workarounds
If you cannot upgrade immediately:
- Use Docker mode with restricted access: Configure TechDocs with
runIn: dockerinstead ofrunIn: local. This provides container isolation, though it does not fully mitigate the risk. - Restrict repository access: Limit who can modify
mkdocs.ymlfiles in repositories that TechDocs processes. Only allow trusted contributors. - Manual review: Implement PR review requirements for changes to
mkdocs.ymlfiles to detect malicioushooksconfigurations before they are merged. - Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features.
Note: Building documentation in CI/CD pipelines using @techdocs/cli does not mitigate this vulnerability, as the CLI uses the same vulnerable @backstage/plugin-techdocs-node package.
References
MkDocs Hooks Documentation MkDocs 1.4 Release Notes TechDocs Architecture
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-techdocs-node"
},
"ranges": [
{
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.14.0"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-techdocs-node"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25153"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T20:19:58Z",
"nvd_published_at": "2026-01-30T22:15:56Z",
"severity": "HIGH"
},
"details": "### Impact\n\nWhen TechDocs is configured with `runIn: local`, a malicious actor who can submit or modify a repository\u0027s `mkdocs.yml` file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration.\n\n### Patches\n\nUpgrade to `@backstage/plugin-techdocs-node` version 1.13.11, 1.14.1 or later.\nThe fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (including `hooks`) are now removed from `mkdocs.yml` before running the generator, with a warning logged to indicate which keys were removed.\n\n**Note**: Users of `@techdocs/cli` should also upgrade to the latest version, which includes the fixed `@backstage/plugin-techdocs-node` dependency.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n1. Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk.\n2. Restrict repository access: Limit who can modify `mkdocs.yml` files in repositories that TechDocs processes. Only allow trusted contributors.\n3. Manual review: Implement PR review requirements for changes to `mkdocs.yml` files to detect malicious `hooks` configurations before they are merged.\n4. Downgrade MkDocs: Use MkDocs \u003c 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features.\n\n**Note**: Building documentation in CI/CD pipelines using `@techdocs/cli` does not mitigate this vulnerability, as the CLI uses the same vulnerable `@backstage/plugin-techdocs-node` package.\n\n### References\n\n[MkDocs Hooks Documentation](https://www.mkdocs.org/user-guide/configuration/#hooks)\n[MkDocs 1.4 Release Notes](https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27)\n[TechDocs Architecture](https://backstage.io/docs/features/techdocs/architecture)",
"id": "GHSA-6jr7-99pf-8vgf",
"modified": "2026-02-02T20:19:58Z",
"published": "2026-02-02T20:19:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-6jr7-99pf-8vgf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25153"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks"
}
GHSA-6JR9-5GR3-C64F
Vulnerability from github – Published: 2022-05-14 01:32 – Updated: 2022-05-14 01:32Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka "OLE Property Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2011-3400"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-12-14T00:55:00Z",
"severity": "HIGH"
},
"details": "Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka \"OLE Property Vulnerability.\"",
"id": "GHSA-6jr9-5gr3-c64f",
"modified": "2022-05-14T01:32:14Z",
"published": "2022-05-14T01:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3400"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-093"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14668"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA11-347A.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6JRP-2CPP-FPM4
Vulnerability from github – Published: 2026-07-17 21:31 – Updated: 2026-07-17 21:31IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system commands with the full privileges of the Langflow server process.
{
"affected": [],
"aliases": [
"CVE-2026-8481"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-17T20:17:30Z",
"severity": "CRITICAL"
},
"details": "IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint.\u00a0The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python\u0027s built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system commands with the full privileges of the Langflow server process.",
"id": "GHSA-6jrp-2cpp-fpm4",
"modified": "2026-07-17T21:31:45Z",
"published": "2026-07-17T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8481"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7278923"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6JVF-R79G-H3F2
Vulnerability from github – Published: 2022-05-02 03:45 – Updated: 2025-04-09 04:15Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP Extension 1.0.5 for Firefox allows remote authenticated SFTP users to cause victims to alter permissions, delete, download, or move the wrong file via a filename containing " (double quotes), which is not properly filtered or encoded when FireFTP constructs the command to send to psftp.exe.
{
"affected": [],
"aliases": [
"CVE-2009-3478"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-09-29T23:30:00Z",
"severity": "MODERATE"
},
"details": "Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP Extension 1.0.5 for Firefox allows remote authenticated SFTP users to cause victims to alter permissions, delete, download, or move the wrong file via a filename containing \" (double quotes), which is not properly filtered or encoded when FireFTP constructs the command to send to psftp.exe.",
"id": "GHSA-6jvf-r79g-h3f2",
"modified": "2025-04-09T04:15:00Z",
"published": "2022-05-02T03:45:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3478"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36860"
},
{
"type": "WEB",
"url": "http://vuln.sg/fireftp105-en.html"
},
{
"type": "WEB",
"url": "http://www.mozdev.org/source/browse/fireftp/src/content/js/connection/controlSocket.js.in.diff?r1=1.74%3Br2=1.75%3Bf=h"
},
{
"type": "WEB",
"url": "http://www.mozdev.org/source/browse/fireftp/src/content/js/connection/controlSocket.js.in.diff?r1=1.74;r2=1.75;f=h"
},
{
"type": "WEB",
"url": "http://www.mozdev.org/source/browse/fireftp/src/content/js/connection/controlSocket.js.in.diff?r1=1.75%3Br2=1.76%3Bf=h"
},
{
"type": "WEB",
"url": "http://www.mozdev.org/source/browse/fireftp/src/content/js/connection/controlSocket.js.in.diff?r1=1.75;r2=1.76;f=h"
},
{
"type": "WEB",
"url": "http://www.mozdev.org/source/browse/fireftp/src/content/js/connection/sftp.js.diff?r1=1.8%3Br2=1.9%3Bf=h"
},
{
"type": "WEB",
"url": "http://www.mozdev.org/source/browse/fireftp/src/content/js/connection/sftp.js.diff?r1=1.8;r2=1.9;f=h"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36536"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6JVG-HP25-42F6
Vulnerability from github – Published: 2024-03-01 06:33 – Updated: 2024-03-01 16:57Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nteract"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.28.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-22891"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-01T16:57:12Z",
"nvd_published_at": "2024-03-01T06:15:48Z",
"severity": "MODERATE"
},
"details": "Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.",
"id": "GHSA-6jvg-hp25-42f6",
"modified": "2024-03-01T16:57:12Z",
"published": "2024-03-01T06:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22891"
},
{
"type": "WEB",
"url": "https://github.com/EQSTLab/PoC/tree/main/2024/RCE/CVE-2024-22891"
},
{
"type": "PACKAGE",
"url": "https://github.com/nteract/nteract"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Nteract Remote Code Execution vulnerability"
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.