Everything Threat Times has reported about Code Injection: 4 stories, newest first. Part of our Vulnerabilities coverage.
A critical vulnerability in Floci allows unauthenticated attackers to execute OS commands via unrestricted Velocity mapping templates in the VtlTemplateEngine.
A critical vulnerability in openapi-typescript-codegen allows attackers to inject JavaScript via OpenAPI documents, affecting versions up to 0.31.0.
A crafted Git branch name can inject JavaScript into TinaCMS CLI builds, allowing attackers to steal credentials or alter deployment artifacts before version 3.0.0.
Amazon patches two vulnerabilities in its open-source Bedrock AgentCore Starter Toolkit that allowed arbitrary code execution and server-side request forgery.