Nedlir

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.

agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious pycache entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.

**Name of the Vulnerable Software and Affected Versions** Rocket.Chat (affected versions not specified) **Description** An unauthenticated caller can repeatedly invoke the `sendForgotPasswordEmail` Meteor method because it lacks a DDP rate limit. This method is accessible via DDP and the HTTP endpoint 'POST /api/v1/method.callAnon/sendForgotPasswordEmail'. Exploitation allows an attacker to send an unlimited volume of password reset emails to a specific address using the system's mail sender. Additionally, the method can be used to probe for accounts; it returns true for addresses without an account or for successful sends, but returns false for accounts using external providers when `Accounts AllowPasswordChangeForOAuthUsers` is disabled, allowing an attacker to identify those specific account types. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** docker-socket-proxy versions prior to 0.5.1 **Description** Insufficient access control granularity occurs when the `CONTAINERS` environment variable is set, failing to properly gate read endpoints within the `/containers` Docker API namespace. This allows attackers to use GET requests to the endpoints '/containers/{id}/archive', '/containers/{id}/export', '/containers/{id}/logs', and '/containers/{id}/top' to read arbitrary files and download entire container filesystems as tar archives. **Recommendations** Update docker-socket-proxy to version 0.5.1 or later. Restrict the use of the `CONTAINERS` environment variable to minimize the risk of unauthorized access to container data.

**Name of the Vulnerable Software and Affected Versions** OpenBoxes versions prior to 0.9.3 **Description** A remote manipulation of the Product Supplier Edit Controller within the file `grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy` can lead to improper authorization. **Recommendations** Upgrade to version 0.9.3.

**Name of the Vulnerable Software and Affected Versions** OpenBoxes versions prior to 0.9.2 **Description** An unrestricted upload issue exists within the Document Upload Controller component. A remote attacker can exploit the `DocumentController()` function located in the `grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy` file to upload files without proper restrictions. **Recommendations** Update to version 0.9.2.

**Name of the Vulnerable Software and Affected Versions** OpenBoxes versions prior to 0.9.8-hotfix1 **Description** An issue exists in the Template Processing component where the `buildZebraTemplate()` function in the `grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy` file fails to properly neutralize special elements used in a template engine. This allows a remote attacker to manipulate the template processing. **Recommendations** Upgrade to version 0.9.8-hotfix1 or 0.9.8. As a temporary mitigation, restrict access to the `buildZebraTemplate()` function.

**Name of the Vulnerable Software and Affected Versions** OpenBoxes versions prior to 0.9.8-hotfix1 **Description** A server-side request forgery (SSRF) exists in the Product Upload Endpoint. A remote attacker can manipulate the `params.url` variable within the `Upload()` function of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy to trigger the issue. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Upgrade to version 0.9.8-hotfix1 or 0.9.8. As a temporary mitigation, restrict access to the `Upload()` function in the Product Upload Endpoint.

**Name of the Vulnerable Software and Affected Versions** OpenBoxes versions prior to 0.9.8-hotfix1 **Description** Remote manipulation of the `needManager()` function within the Role Interceptor component (located in grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy) can lead to improper privilege management. **Recommendations** Update to version 0.9.8-hotfix1 or 0.9.8. As a temporary mitigation, restrict access to the `needManager()` function.

**Name of the Vulnerable Software and Affected Versions** keystonejs keystone versions prior to 20260319 **Description** A remote resource consumption issue exists within the GraphQL API Endpoint component, specifically affecting the library `packages/core/src/lib/core/queries/output-field.ts`. This allows a remote attacker to manipulate the system, leading to excessive resource usage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** APScheduler (affected versions not specified) **Description** The JSONSerializer and CBORSerializer are subject to Remote Code Execution (RCE) through insecure deserialization. The `unmarshal object()` function enables arbitrary class instantiation and state injection by dynamically importing modules and calling ` setstate ` on any class present in the Python environment. This can be triggered by submitting a specially crafted JSON or CBOR payload to an application utilizing these serializers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PrefectHQ prefect versions prior to 3.6.25.dev7 **Description** An argument injection issue exists in the GitRepository Pull Handler component within the `src/prefect/runner/storage.py` file. Remote attackers can exploit this by manipulating the `commit sha` or `directories` arguments. **Recommendations** Upgrade to version 3.6.25.dev7.

**Name of the Vulnerable Software and Affected Versions** PrefectHQ prefect versions prior to 3.6.22 **Description** Improper authentication in the Health Check API allows a remote attacker to perform a manipulation. This issue specifically impacts the `endswith()` function within the '/api/health' endpoint. **Recommendations** Update to version 3.6.22.

**Name of the Vulnerable Software and Affected Versions** PrefectHQ prefect versions prior to 3.6.28.dev2 **Description** A time-of-check time-of-use (TOCTOU) issue exists in the `validate restricted url()` function of the Webhook/Notification component. This flaw allows a remote attacker to manipulate the system, although the attack is characterized by high complexity and is difficult to exploit. **Recommendations** Update to version 3.6.28.dev2.

**Name of the Vulnerable Software and Affected Versions** PrefectHQ prefect versions prior to 3.6.14 **Description** A flaw in the WebSocket Endpoint component allows a remote attacker to perform a manipulation that leads to missing authentication. The issue is located within the '/api/events/in' endpoint. **Recommendations** Upgrade to version 3.6.14.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.2.19 **Description** The software contains a command injection issue within the `tools.exec.safeBins` component. This allows attackers to bypass restrictions intended for stdin-only operations. Specifically, the use of sort output flags or recursive grep flags can be exploited. Attackers can perform arbitrary file writes using `sort -o` or recursive file reads using `grep -R`, effectively circumventing the safe-bin execution restrictions. **Recommendations** Update to version 2026.2.19 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.2.23 **Description** The software contains an authorization bypass issue in the ACP client. The client auto-approves tool calls based on untrusted `toolCall.kind` metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths. **Recommendations** Update OpenClaw to version 2026.2.23 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.2.19-2 **Description** A flaw exists in the `applySkillConfigenvOverrides` function within the Skill Env Handler component. This issue allows for code injection when a manipulation is executed remotely. The issue arises because the function copies `skills.entries.*.env` values into the host `process.env` without applying host environment safety policies, potentially allowing injection of dangerous process-level variables like `NODE OPTIONS`. An attacker must be able to modify OpenClaw local state or configuration to set `skills.entries.<skill>.env` or related skill config values. **Recommendations** Upgrade to OpenClaw version 2026.2.21-beta.1 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** eBay API MCP Server (all versions) **Description** An environment variable injection issue exists in the `updateEnvFile` function located in `src/auth/oauth.ts`. The `ebay set user tokens` tool allows updating the `.env` file with new tokens, but the `updateEnvFile` function appends or replaces values without validating them for quotes or newlines. This lack of sanitization enables an attacker to inject arbitrary environment variables into the configuration file. Potential impacts include configuration overwrites, such as hijacking OAuth flows by modifying `EBAY REDIRECT URI`, Denial of Service by injecting invalid configurations, and Remote Code Execution (RCE) by controlling variables like `NODE OPTIONS`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `ebay set user tokens` tool and the `updateEnvFile` function to minimize the risk of exploitation.