CWE-94 Improper Control of Generation of Code ('Code Injection')

Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability

Tina: Code injection via unescaped Git branch name in generated client source

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Duplicate Advisory: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Duplicate Advisory: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Duplicate Advisory: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Ghost: Remote Code Execution via Bookmark Card Images

Payload: Remote Code Execution through first-register

Payload Form Builder has an RCE issue

Ghost: Remote Code Execution via Theme Translation Files

Hydra logging configuration permits unsafe callable resolution

Backstage: Improper validation of MkDocs theme configuration in TechDocs

Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Duplicate Advisory: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation