P1 · CVSS 8.8 HIGH
OS Command Injection in picoclaw via incomplete guardCommand() denylist: CVE-2026-36045
Target: picoclaw Go package (sipeed/picoclaw) · Jun 2026 · Gist reference
Identified OS command injection in pkg/tools/shell.go within guardCommand() of ExecTool. The denylist covered only 8 disk-destruction patterns (rm -rf variants, dd, mkfs, shutdown, fork bomb) with zero coverage for shell invocation, pipe-to-shell, sudo, eval, chmod, or scripting interpreters. Since allowPatterns is nil by default, any command passing the 8 patterns executed unconditionally via exec.CommandContext("sh", "-c", command). Confirmed 15 bypass payloads with 0 false positives against v0.1.2. A secondary vector: prompt injection via any connected messaging channel (Telegram, Discord, Slack, LINE, WhatsApp, DingTalk) causes the AI agent to invoke ExecTool with a malicious command, a remote messaging-channel-to-OS-RCE chain.
Impact: arbitrary OS command execution with the privileges of the picoclaw process, exposing OAuth tokens and all provider API keys (Anthropic, OpenAI, OpenRouter, Groq, Gemini) plus messaging bot tokens. On root-privileged embedded targets (Sipeed LicheeRV Nano), also grants direct hardware access via I2C/SPI tools. No vendor fix released at time of writing.
P1 · CVSS 8.8 HIGH
OS Command Injection in @pensar/apex: CVE-2026-36044
Target: @pensar/apex npm package (pensarai/apex) · Jun 2026 · Gist reference
Identified OS command injection in src/core/agent/tools.ts within createSmartEnumerateTool(): the extensions array and url parameter were concatenated unsanitized into a Node.js child_process.exec() shell command. Confirmed three working attack vectors: $() substitution, semicolon injection, and double-quote URL escape. Secondary vector: attacker-controlled web content instructs the LLM to pass malicious extensions to smart_enumerate, chaining prompt injection to OS RCE. Verified on v0.0.58.
Impact: arbitrary OS command execution with the privileges of the running process on a developer's local machine, exposing high-value targets like SSH keys, cloud credentials, GitHub tokens, and source code. Vendor confirmed a fix in an upcoming release following coordinated disclosure; CVE request submitted to MITRE.
P1 · CVSS 9.1 CRITICAL
Path Traversal via dagRunId in dagu Inline DAG Execution: CVE-2026-31886
Target: github.com/dagu-org/dagu · Mar 2026 · GitHub advisory
Identified path traversal in internal/service/frontend/api/v1/dagruns.go within loadInlineDAG(). The dagRunId request field is passed unsanitized into filepath.Join(os.TempDir(), nameHint, dagRunID); supplying dagRunId=".." resolves to /tmp. A deferred cleanup closure calls os.RemoveAll(tmpDir) unconditionally on every return path. The OpenAPI schema's restrictive pattern requires StrictValidation=true, which is structurally impossible to enable, confirmed by the loader test suite. Both POST /api/v1/dag-runs and /enqueue are affected. Secondary vector: a deeper traversal writes attacker-controlled YAML to the DAGs directory and executes it before cleanup deletes it.
Impact: any authenticated operator can trigger os.RemoveAll("/tmp") with a single HTTP request, repeatable with no rate limiting, wiping the entire /tmp directory on root/Docker deployments. Secondary impact: arbitrary YAML write enables persistent command execution; tertiary impact: permanent destruction of all workflow definitions. Versions ≤1.30.3 exploitable without credentials (default auth.mode: none).
P1 · CVSS 8.1 HIGH
Header Injection / Privilege Escalation in caddyserver/caddy: CVE-2026-30851 (first CVE)
Target: caddyserver/caddy/v2/modules/caddyhttp/reverseproxy · Mar 2026 · GitHub advisory · PR #7545
Identified a header injection vulnerability in forwardauth/caddyfile.go within parseCaddyfile(). An earlier fix (PR #6608) introduced a MatchNot guard that skips the header Set operation when the auth service doesn't return a configured header, removing the incidental protection the old code had, with no Delete operation anywhere in the function. Confirmed attack: attacker holding any valid non-privileged token sends X-User-Id: admin; auth service returns 200 with no identity headers; Caddy forwards the forged value to the backend. Verified on v2.11.1.
Impact: privilege escalation to arbitrary identity on any backend trusting copy_headers for authorization, requiring only a valid non-privileged token, no admin account needed. Affects deployments using forward_auth with copy_headers, including the common Authelia bypass-rules pattern and stateless JWT validators. Fixed in v2.11.2.
P2
Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection in openclaw/openclaw
Target: openclaw/openclaw MCP tool result media pipeline · Feb 2026 · GitHub advisory
Identified missing tool-trust validation in the MCP tool result media pipeline: extractToolResultMediaPaths() parsed MEDIA: directives from tool result text without validating source trust level, letting any MCP tool server inject arbitrary local file paths. buildMediaLocalRoots() included os.tmpdir() in the default allowlist. Fix added a trusted-tool allowlist, replaced os.tmpdir() with a narrow mode-0o700 subdirectory, and stripped media paths from untrusted tool results. Verified with 21 passing test cases.
Impact: a malicious/compromised MCP tool server could exfiltrate arbitrary local files (SSH keys, cloud credentials, session tokens) via external messaging channels (Discord, Slack, Telegram, WhatsApp) without user confirmation. Fix merged upstream.
P2
Canvas Host Missing Security Headers Enables XSS and Clickjacking in openclaw/openclaw
Target: openclaw/openclaw canvas host HTTP server · Feb 2026 · GitHub advisory
Identified missing CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers in the canvas host handler, while an equivalent control-UI handler in the same codebase correctly applied all four, confirming an oversight (acknowledged in a code comment). SVG/HTML files served this way support embedded scripts that execute unrestricted without CSP.
Impact: an attacker able to place files in the canvas root (via malicious MCP tool, agent-created content, or compromised plugin) achieves arbitrary JS execution: session hijacking via cookies/localStorage, data exfiltration, clickjacking, MIME sniffing, referrer leakage of capability tokens. Published by the maintainer as "Canvas route hardening for mixed-trust deployments."
P2
XML Injection in trailofbits/skills ct_analyzer
Target: trailofbits/skills (ct_analyzer Python plugin) · Feb 2026 · PR #106
Identified missing XML escaping in CSharpAnalyzer._compile_csharp(): a .csproj MSBuild file embeds a filename verbatim into an XML attribute with no sanitization. A crafted filename closes the XML attribute context and injects a <Target BeforeTargets="Build"><Exec Command="..."/> block that dotnet build executes unconditionally before compilation. Fix wraps values with xml.sax.saxutils.escape().
Impact: attacker-controlled shell commands execute as the user running ct_analyzer. Highest-severity path is CI/CD: a PR containing a maliciously-named .cs file triggers the injected MSBuild target before compilation, with full access to pipeline secrets, silently, with no confirmation prompt.
P3
Security Control Bypass in trailofbits/claude-code-config
Target: trailofbits/claude-code-config settings.json · Feb 2026 · PR #33
Identified incomplete deny-rule and hook-regex coverage in Trail of Bits' recommended Claude Code security baseline: deny rules only matched lowercase combined-flag rm -rf/-fr, leaving 14+ flag-order/case variants unblocked; the PreToolUse hook regex was case-sensitive and missed separated/long-form flags; pipe-to-shell protection only covered | bash. Fix expanded to 19 rm patterns and 5 pipe-to-shell patterns with case-insensitive chained checks, verified against 25 test cases.
Impact: silent bypass of both security layers, exploitable via prompt injection using any unblocked flag form; pipe-to-shell bypass enables RCE via | sh or bash <(curl ...). Published as a trusted security baseline, so gaps created false confidence for adopting users. Fix merged upstream.
P3
SSRF Detection Bypass in fickling
Target: github.com/trailofbits/fickling · Feb 2026 · GitHub advisory · PR #233
Identified a detection bypass in Trail of Bits' fickling library: pickle files initiating outbound TCP connections via stdlib network-protocol constructors (smtplib, imaplib, ftplib, poplib, telnetlib, nntplib) were rated LIKELY_SAFE with zero warnings, combining a blocklist gap with a logic flaw that let a specific opcode sequence suppress the unused-variable heuristic entirely.
Impact: malicious pickle files (e.g. crafted ML model checkpoints) passed fickling's safety gate silently, enabling victim enumeration, host identity exfiltration, internal recon (SSRF), and covert channels. Reported directly to Trail of Bits' CEO; fix merged in PR #233; credited in the published advisory.
P1
Source Code Disclosure via Direct File Access
Target: www.sgrdimsr.in · Jan 2026
Identified critical information disclosure where the application exposed complete PHP source code through direct HTTP requests to template files, revealing database schema, file system paths, application architecture, and vulnerable code patterns without authentication.
Impact: significantly widened the attack surface by revealing internals, database structure, and stack; enabled identification of further vulnerabilities including SQL injection points and facilitated advanced persistent threats via exposed file paths and framework components.
P2
SQL Injection via Vulnerable Code Pattern
Target: www.sgrdimsr.in · Jan 2026
Discovered evidence of SQL injection through exposed source-code analysis: direct variable interpolation in database queries without prepared statements, with SQL error messages exposed client-side revealing malformed query construction and database version information.
Impact: significant risk of database compromise, including unauthorized data access, manipulation, or deletion; potential data exfiltration, authentication bypass, or privilege escalation. Exposed database structure and errors further aided targeted injection payloads.
P1
Sensitive Personal Data Exposure: Student PII Disclosure
Target: www.sgrdimsr.in · Jan 2026
Identified a critical data privacy violation: a publicly accessible PDF exposed comprehensive records of 150+ students, including full names, dates of birth, academic performance, entrance exam scores, financial information, and category classifications, without authentication, violating India's Digital Personal Data Protection Act 2023 and IT Act 2000.
Impact: exposed PII of 150+ individuals without consent, enabling identity theft, social engineering, targeted harassment, and financial fraud; category-data exposure risked discrimination; exposed the institution to legal/regulatory action.
P1
Full Account Takeover via MailCatcher Instances
Program: State of Maryland VDP · Target: *.md.gov · Jan 2026 · Program page
Identified critical infrastructure exposure: multiple dev/test environments ran unauthenticated MailCatcher instances intercepting all outgoing system email, including plaintext password reset tokens and account verification links, allowing real-time interception and subversion of the entire authentication lifecycle.
Impact: demonstrated a proven Full Account Takeover on government infrastructure, compromising any account (including government employees and contractors) and enabling mass PII harvesting and internal business communication exposure.
P1
Publicly Accessible MailCatcher Instance Exposing Sensitive Data
Program: State of Maryland VDP · Target: *.md.gov · Jan 2026 · Program page
Identified an unauthenticated MailCatcher instance on a government training subdomain, exposing full contents of intercepted emails, including live password reset tokens, verification links, and PII of employees, contractors, and external users.
Impact: critical risk of widespread account takeover across the training environment, including @maryland.gov staff and contractors, plus significant PII disclosure enabling highly targeted social engineering and BEC attacks against state infrastructure.
P5
CSRF: Unauthorized Shopping Cart Clearing via GET Request
Program: State of Maryland VDP · Target: *.maryland.gov · Jan 2026 · Program page
The shopping cart's predictable GET request performed a state-changing "clear cart" operation with no CSRF token, referrer validation, or SameSite cookie attribute, triggerable cross-origin, including via a hidden element on a third-party page firing automatically on load.
Impact: allowed disruption of user experience by clearing carts without consent, risking cart abandonment and revenue loss; highlighted a deviation from RFC 7231 (GET must stay idempotent).
P5
Multiple Account Enumeration Vulnerabilities across Maryland State Infrastructure
Program: State of Maryland VDP · Target: *.maryland.gov, *.md.gov · Jan 2026 · Program page
Identified logical flaws in authentication/password-recovery flows across multiple government subdomains that disclosed account validity via distinct error messages or UI states, confirmed as non-brute-force, single-request-per-identity enumeration.
Impact: enabled mass reconnaissance and a validated database of government employees, health-system users, and citizens, narrowing the scope for credential stuffing, phishing, and social engineering against sensitive health and benefit systems.
P3
Account Enumeration at Login Portal
Target: *.sourcecode.com · Dec 2025
Identified a user enumeration flaw in POST /en-us/lostpass: the server returned distinct "No record found" errors, allowing systematic discovery of valid accounts.
Impact: exposed the user base to reconnaissance and increased the success rate of credential stuffing attacks. Recommended fix: generic error messages and consistent response timing to remove the oracle.