tag
Code-Execution
Ghidra — Swift Demangler Arbitrary Code Execution via Shared Project Files (CVE-2026-18718)
Opening someone else's Ghidra project is enough to execute their code — with no prompt, no signature check, and no integrity verification.
Langflow Custom Component Remote Code Execution — CVE-2026-33017
Langflow exposes a REST API endpoint that builds and runs a "flow" — a graph of nodes describing a data/LLM pipeline. One of the supported node types is a generic custom component whose code field is arbitrary Python that Langflow imports and executes…
AI Model-Loader `trust_remote_code` Order-of-Operations RCE Simulation (CVE-2026-22807)
This repository is a small, self-contained Python testbed (vulnerablelib.py) that reproduces a class of AI supply-chain vulnerability found in model-loading frameworks: when a loader resolves a model's Python class via a config.json's automap field, it can…
ImageMagick Ghostscript Delegate Search Path Hijack
When ImageMagick converts PDF/PS/EPS-family inputs on Windows and cannot resolve a full path to Ghostscript, it falls back to invoking the bare executable name gswin64c.exe and launches it through the Windows process API with the application name left unset —…
c-ares TCP ares_getaddrinfo() Use-After-Free Code Execution
c-ares's aresgetaddrinfo() path over DNS-over-TCP with EDNS enabled contains a use-after-free reachable when a malicious or compromised DNS server sends two responses for the same query ID in a single TCP read — the first a FORMERR without OPT data…