Loading story…
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. Coder Workspace Agent patched GHSA-QRWJ-VH9X-GW5V, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP 307/308 redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions v2.34.4, v2.33.10, v2.32.9, and v2.29.19 ESR. Coolify disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as dockerfile_location, allowing RCE and secrets exposure through deployment logs, while OpenRemote fixed GHSA-cgfv-jrfp-2r7v, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials.
Additional disclosures affected AI and package-management components. Langroid fixed a prompt-injection-driven flaw in Neo4jChatAgent that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version 0.65.5 with new safety controls that were also extended to ArangoChatAgent. pnpm also reported a path traversal weakness in configDependencies processing from pnpm-lock.yaml, where a malicious repository could force symlink creation outside node_modules/.pnpm-config even with --ignore-scripts, creating a filesystem write primitive within or potentially beyond the project directory.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
A security fix was merged for Conversation Guard's port_forward functionality after maintainers found user-controlled arguments reached kubectl via spawn() without assertSafeArgv validation. The patch added argument validation, preserved InvalidParams error handling, and introduced regression tests for a proof of concept that could redirect kubectl to an attacker-controlled API server and expose the operator's bearer token.
Coder fixed a high-severity SSH configuration injection vulnerability in `coder config-ssh` where server-supplied values such as `HostnameSuffix` and `SSHConfigOptions` could inject arbitrary directives into a user's `~/.ssh/config` due to insufficient sanitization. The issue was addressed by validating those fields against a strict character set in patched releases 2.29.17, 2.32.7, 2.33.8, and 2.34.2.
Coder addressed a high-severity authorization flaw in the tailnet coordinator that allowed route hijacking because agent-supplied AllowedIPs were not validated against the authenticating agent's UUID before being forwarded to tunnel peers. The issue affected multiple release lines and was fixed by adding AllowedIPs validation in patched releases.
Coder fixed a high-severity authorization flaw that allowed cross-workspace agent reassignment because UpsertWorkspaceApp could overwrite an existing app's agent_id on primary-key conflict without verifying workspace ownership. The issue was patched in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 by validating ownership of existing workspace_apps rows and rejecting cross-workspace rebinding.
OpenRemote addressed an authenticated SQL injection vulnerability in the Manager datapoint crosstab export feature in version 1.26.0. The fix replaced user-controlled SQL identifiers with synthetic server-side column keys and moved friendly CSV header generation out of the database execution context.
Coder fixed a high-severity cross-agent server-side request forgery and remote code execution issue in Workspace Agent by disabling redirect following and pinning the destination agent address. Patched releases were issued as v2.34.4, v2.33.10, v2.32.9, and v2.29.19 ESR.
A GitHub advisory disclosed a critical authenticated remote command injection vulnerability in Coolify that can lead to remote code execution and secrets exfiltration through deployment logs. The report included proof-of-concept exploit code and identified unsafe handling of fields such as dockerfile_location and pre_deployment_command.
A GitHub advisory described a path traversal vulnerability in pnpm's handling of configDependencies entries from the env lockfile section of pnpm-lock.yaml. The issue can let a malicious repository cause symlink creation outside node_modules/.pnpm-config during install, including when run with --ignore-scripts.
Langroid resolved a prompt-injection-driven Cypher execution flaw in Neo4jChatAgent in version 0.65.5 by adding allow_dangerous_operations controls and validation. Similar protections were also applied to ArangoChatAgent.
A GitHub advisory disclosed a critical Langroid vulnerability in TableChatAgent and VectorStore where LLM-generated tool messages evaluated with Python eval() could escape the intended sandbox and achieve unauthenticated remote code execution. The advisory described access to dangerous built-ins via incomplete eval() mitigation and included a proof of concept that executed host commands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.
Jun 29, 2026
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026