CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Docling imports plugin entry points before the allow_external_plugins check

Ghost: Remote Code Execution via Theme Translation Files

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

FASTJSON Includes Functionality from Untrusted Control Sphere

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

Joker linter executed project-local .jokerd/linter.* files during linting

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability

containerd: CRI checkpoint import allows local image tag poisoning

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

Pi Agent: Pi loads project-local extensions without approval