CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8376 vulnerabilities reference this CWE, most recent first.
GHSA-PWWF-7F48-895H
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-15 15:30A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.
Note: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.
{
"affected": [],
"aliases": [
"CVE-2022-46874"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "HIGH"
},
"details": "A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.\u003cbr/\u003e*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox \u003c 108, Thunderbird \u003c 102.6.1, Thunderbird \u003c 102.6, and Firefox ESR \u003c 102.6.",
"id": "GHSA-pwwf-7f48-895h",
"modified": "2025-04-15T15:30:38Z",
"published": "2022-12-22T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46874"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-06"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-13"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-51"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-52"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-53"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PWWH-9MWX-42H3
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2022-05-24 17:09Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.
{
"affected": [],
"aliases": [
"CVE-2019-4000"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-25T21:15:00Z",
"severity": "HIGH"
},
"details": "Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.",
"id": "GHSA-pwwh-9mwx-42h3",
"modified": "2022-05-24T17:09:36Z",
"published": "2022-05-24T17:09:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4000"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2020-12"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PWXW-WM47-24W6
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2022-05-13 01:37IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628.
{
"affected": [],
"aliases": [
"CVE-2017-1248"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-06T14:29:00Z",
"severity": "MODERATE"
},
"details": "IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim\u0027s Web browser within the security context of the hosting site. IBM X-Force ID: 124628.",
"id": "GHSA-pwxw-wm47-24w6",
"modified": "2022-05-13T01:37:12Z",
"published": "2022-05-13T01:37:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1248"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/124628"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10716201"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PWXX-2HRW-72W5
Vulnerability from github – Published: 2022-05-24 17:29 – Updated: 2025-10-22 00:31A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
{
"affected": [],
"aliases": [
"CVE-2020-25223"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-25T04:23:00Z",
"severity": "CRITICAL"
},
"details": "A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11",
"id": "GHSA-pwxx-2hrw-72w5",
"modified": "2025-10-22T00:31:58Z",
"published": "2022-05-24T17:29:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25223"
},
{
"type": "WEB",
"url": "https://community.sophos.com/b/security-blog"
},
{
"type": "WEB",
"url": "https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25223"
},
{
"type": "WEB",
"url": "https://www.secpod.com/blog/remote-code-execution-in-sophos-utm"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PX3P-5C29-4JXR
Vulnerability from github – Published: 2022-03-03 00:00 – Updated: 2022-03-17 00:04diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
{
"affected": [],
"aliases": [
"CVE-2021-41282"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-01T23:15:00Z",
"severity": "HIGH"
},
"details": "diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.",
"id": "GHSA-px3p-5c29-4jxr",
"modified": "2022-03-17T00:04:24Z",
"published": "2022-03-03T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41282"
},
{
"type": "WEB",
"url": "https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html"
},
{
"type": "WEB",
"url": "https://www.shielder.it/advisories"
},
{
"type": "WEB",
"url": "https://www.shielder.it/advisories/pfsense-remote-command-execution"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/166208/pfSense-2.5.2-Shell-Upload.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PX5M-H76G-P7P8
Vulnerability from github – Published: 2026-07-09 21:03 – Updated: 2026-07-09 21:03Summary
An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution.
Details
Affected Component - File: tools/bazar/fields/CalcField.php - Method: formatValuesBeforeSave($entry) - Vulnerable Mechanism: Combination of a complex recursive regex validation followed by eval().
The code attempts to implement a sandbox for mathematical operations by verifying the formula structure before executing it:
$regexpToCheckIfMathFormula = '/^((' . $number . '|' . $functions . '\s*\((?1)+\)|\((?1)+\))(?:' . $operators . '(?1))?)+$/';
if (preg_match($regexpToCheckIfMathFormula, $formula)) {
$formula = preg_replace('!pi|π!', 'pi()', $formula);
try {
eval("\$value = $formula;"); // VULNERABLE LINE
// ...
Architectural Flaws
PCRE Stack Overflow & ReDoS (The Immediate Exploit):
The regex definition heavily relies on a recursive pattern (?1)+. In PHP's PCRE engine, deeply nested recursive patterns are processed on the system stack. If an attacker inputs a formula with thousands of nested parentheses or repeating groups, the engine will either trigger a pcre.recursion_limit exhaust (returning false or null) or cause a Segmentation Fault, instantly crashing the PHP process (Denial of Service).
The "Validation-Before-Substitution" Trap:
The regex checks the $formula variable after it has tokenized and reassembled the input string. If any underlying function called during tokenization (like testEntryValue or future updates to getEntryValue) returns or leaks an unexpected string format, the string structure changes.
Complete Trust in eval():
Using eval() as a math parser means the application's security perimeter relies entirely on a single regular expression. History shows that complex regex sanitizers for script evaluation are consistently bypassed via edge-case syntaxes, character encoding tricks, or PCRE engine bugs.
PoC
Scenario A: Remote Denial of Service (Server Crash)
An attacker with rights to create or edit a Bazar form adds a Calc field and injects a deeply nested recursive mathematical structure.
Payload:
((((((((((((((((((((((((((((((((((((((((((1+1))))))))))))))))))))))))))))))))))))))))))))
(Multiplied by 2000 to 5000 iterations depending on the server's pcre.recursion_limit and stack configuration).
The PCRE engine runs out of stack memory, leading to an immediate crash of the PHP-FPM worker or Apache process handling the request, rendering the service unavailable.
Scenario B: Logical Bypass to RCE
Because eval() executes raw PHP code, if an attacker successfully fuzzes the recursive pattern or exploits an unpatched vulnerability in the specific PCRE library version installed on the host OS, they can slip a PHP payload through the validation block.
Payload:
abs(1) + system('id')
If a validation bypass occurs, the string evaluates as native PHP, granting the attacker the privileges of the www-data (web server) user, leading to a full host compromise.
Impact
-
Confidentiality: HIGH. Attackers can read sensitive system files (e.g., /etc/passwd, .env configuration files).
-
Integrity: HIGH. Attackers can modify application files, inject backdoors, or alter the database content.
-
Availability: HIGH. Attackers can easily bring down the web service via the ReDoS/Segmentation Fault vector.
Remediation & Mitigation
- Do not use regular expressions to safe-guard eval(). Instead, replace the execution block with a dedicated, safe Abstract Syntax Tree (AST) math parser or an expression language component that cannot execute system context.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "yeswiki/yeswiki"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52778"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T21:03:04Z",
"nvd_published_at": "2026-06-08T19:16:46Z",
"severity": "CRITICAL"
},
"details": "### Summary\n\nAn unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution.\n\n### Details\n\nAffected Component\n- **File**: tools/bazar/fields/CalcField.php\n- **Method**: formatValuesBeforeSave($entry)\n- **Vulnerable Mechanism:** Combination of a complex recursive regex validation followed by eval().\n\n\nThe code attempts to implement a sandbox for mathematical operations by verifying the formula structure before executing it:\n\n```\n$regexpToCheckIfMathFormula = \u0027/^((\u0027 . $number . \u0027|\u0027 . $functions . \u0027\\s*\\((?1)+\\)|\\((?1)+\\))(?:\u0027 . $operators . \u0027(?1))?)+$/\u0027;\n\nif (preg_match($regexpToCheckIfMathFormula, $formula)) {\n $formula = preg_replace(\u0027!pi|\u03c0!\u0027, \u0027pi()\u0027, $formula);\n try {\n eval(\"\\$value = $formula;\"); // VULNERABLE LINE\n// ...\n```\n### Architectural Flaws\n\n**PCRE Stack Overflow \u0026 ReDoS (The Immediate Exploit):**\n\nThe regex definition heavily relies on a recursive pattern (?1)+. In PHP\u0027s PCRE engine, deeply nested recursive patterns are processed on the system stack. If an attacker inputs a formula with thousands of nested parentheses or repeating groups, the engine will either trigger a pcre.recursion_limit exhaust (returning false or null) or cause a Segmentation Fault, instantly crashing the PHP process (Denial of Service).\n\n**The \"Validation-Before-Substitution\" Trap:**\n\nThe regex checks the $formula variable after it has tokenized and reassembled the input string. If any underlying function called during tokenization (like testEntryValue or future updates to getEntryValue) returns or leaks an unexpected string format, the string structure changes.\n\n**Complete Trust in eval():**\n\nUsing eval() as a math parser means the application\u0027s security perimeter relies entirely on a single regular expression. History shows that complex regex sanitizers for script evaluation are consistently bypassed via edge-case syntaxes, character encoding tricks, or PCRE engine bugs.\n\n### PoC\n\n**Scenario A: Remote Denial of Service (Server Crash)**\n\nAn attacker with rights to create or edit a Bazar form adds a Calc field and injects a deeply nested recursive mathematical structure.\n\nPayload:\n\n`((((((((((((((((((((((((((((((((((((((((((1+1))))))))))))))))))))))))))))))))))))))))))))\n`\n\n(Multiplied by 2000 to 5000 iterations depending on the server\u0027s pcre.recursion_limit and stack configuration).\n\nThe PCRE engine runs out of stack memory, leading to an immediate crash of the PHP-FPM worker or Apache process handling the request, rendering the service unavailable.\n\n**Scenario B: Logical Bypass to RCE**\n\nBecause eval() executes raw PHP code, if an attacker successfully fuzzes the recursive pattern or exploits an unpatched vulnerability in the specific PCRE library version installed on the host OS, they can slip a PHP payload through the validation block.\n \nPayload:\n\n`abs(1) + system(\u0027id\u0027)\n`\n\nIf a validation bypass occurs, the string evaluates as native PHP, granting the attacker the privileges of the www-data (web server) user, leading to a full host compromise.\n\n### Impact\n\n- Confidentiality: HIGH. Attackers can read sensitive system files (e.g., /etc/passwd, .env configuration files).\n\n- Integrity: HIGH. Attackers can modify application files, inject backdoors, or alter the database content.\n\n- Availability: HIGH. Attackers can easily bring down the web service via the ReDoS/Segmentation Fault vector.\n\n### Remediation \u0026 Mitigation\n\n- Do not use regular expressions to safe-guard eval(). Instead, replace the execution block with a dedicated, safe Abstract Syntax Tree (AST) math parser or an expression language component that cannot execute system context.",
"id": "GHSA-px5m-h76g-p7p8",
"modified": "2026-07-09T21:03:04Z",
"published": "2026-07-09T21:03:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52778"
},
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52"
},
{
"type": "PACKAGE",
"url": "https://github.com/YesWiki/yeswiki"
},
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution \u0026 Denial of Service"
}
GHSA-PX64-CPGR-654P
Vulnerability from github – Published: 2024-10-25 18:30 – Updated: 2024-10-25 21:31File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component.
{
"affected": [],
"aliases": [
"CVE-2024-48581"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T16:15:10Z",
"severity": "CRITICAL"
},
"details": "File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component.",
"id": "GHSA-px64-cpgr-654p",
"modified": "2024-10-25T21:31:27Z",
"published": "2024-10-25T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48581"
},
{
"type": "WEB",
"url": "https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20Unrestricted%20File%20Upload%20to%20RCE%20%28Sign%20Up%29.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PX8F-PF56-946W
Vulnerability from github – Published: 2024-08-27 18:31 – Updated: 2024-08-28 15:31HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.
{
"affected": [],
"aliases": [
"CVE-2024-7720"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-27T18:15:15Z",
"severity": "CRITICAL"
},
"details": "HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product\u0027s solution open-source libraries.",
"id": "GHSA-px8f-pf56-946w",
"modified": "2024-08-28T15:31:13Z",
"published": "2024-08-27T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7720"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_11074404-11074432-16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PX8V-HXXX-2RGH
Vulnerability from github – Published: 2020-05-08 21:00 – Updated: 2021-10-27 17:00Impact
A potential Server-Side Template Injection vulnerability exists in Sprout Forms which could lead to the execution of Twig code.
Patches
The problem is fixed inbarrelstrength/sprout-forms:v3.9.0 which upgrades to barrelstrength/sprout-base-email:v1.2.7
Workarounds
Users unable to upgrade should update any Notification Emails to use the "Basic Notification (Sprout Email)" template and avoid using the "Basic Notification (Sprout Forms)" template or any custom templates that display Form Fields.
References
- See the release notes in the CHANGELOG
- Credits to Paweł Hałdrzyński, Daniel Kalinowski from ISEC.PL for discovery and responsible disclosure
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Sprout Forms repo
- Email us at sprout@barrelstrengthdesign.com
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "barrelstrength/sprout-base-email"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "barrelstrength/sprout-forms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-11056"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2020-05-08T19:12:33Z",
"nvd_published_at": "2020-05-07T21:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nA potential Server-Side Template Injection vulnerability exists in Sprout Forms which could lead to the execution of Twig code.\n\n### Patches\n\nThe problem is fixed in`barrelstrength/sprout-forms:v3.9.0` which upgrades to `barrelstrength/sprout-base-email:v1.2.7`\n\n### Workarounds\n\nUsers unable to upgrade should update any Notification Emails to use the \"Basic Notification (Sprout Email)\" template and avoid using the \"Basic Notification (Sprout Forms)\" template or any custom templates that display Form Fields.\n\n### References\n\n- See the release notes in the [CHANGELOG](https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical)\n- Credits to Pawe\u0142 Ha\u0142drzy\u0144ski, Daniel Kalinowski from [ISEC.PL](https://isec.pl/) for discovery and responsible disclosure\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in the [Sprout Forms repo](https://github.com/barrelstrength/craft-sprout-forms/issues)\n* Email us at [sprout@barrelstrengthdesign.com](mailto:sprout@barrelstrengthdesign.com)",
"id": "GHSA-px8v-hxxx-2rgh",
"modified": "2021-10-27T17:00:42Z",
"published": "2020-05-08T21:00:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/barrelstrength/craft-sprout-forms/security/advisories/GHSA-px8v-hxxx-2rgh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11056"
},
{
"type": "WEB",
"url": "https://github.com/barrelstrength/craft-sprout-base-email/commit/5ef759f4713ede6dbf77c9d9df9f992876e43a49"
},
{
"type": "WEB",
"url": "https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Potential Code Injection in Sprout Forms"
}
GHSA-PXC4-295P-35QQ
Vulnerability from github – Published: 2026-07-14 21:32 – Updated: 2026-07-14 21:32Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
{
"affected": [],
"aliases": [
"CVE-2026-15410"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T20:16:56Z",
"severity": "HIGH"
},
"details": "Post-authentication improper control of generation of code (\u0027Code Injection\u0027) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.",
"id": "GHSA-pxc4-295p-35qq",
"modified": "2026-07-14T21:32:16Z",
"published": "2026-07-14T21:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15410"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.