Common Weakness Enumeration
CWE-470
AllowedUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Abstraction: Base · Status: Draft
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
127 vulnerabilities reference this CWE, most recent first.
CVE-2026-114508 (GCVE-0-2026-114508)
Vulnerability from cvelistv5 – Published: 2026-10-21 21:45 – Updated: 2026-10-23 21:18
VLAI
EPSS
VEX
Title
Laravel relationship inclusion can trigger unauthorized data destruction
Summary
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 17:32 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Assigner
GitHub_M
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/laravel/framework/security/adv… | x_refsource_CONFIRM |
| https://github.com/laravel/framework/pull/61322 | x_refsource_MISC |
| https://github.com/laravel/framework/pull/61323 | x_refsource_MISC |
| https://github.com/laravel/framework/commit/50a79… | x_refsource_MISC |
| https://github.com/laravel/framework/commit/b89f2… | x_refsource_MISC |
| https://github.com/laravel/framework/releases/tag… | x_refsource_MISC |
| https://github.com/laravel/framework/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T17:32:51.979205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:18:11.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "framework",
"vendor": "laravel",
"versions": [
{
"status": "affected",
"version": "\u003e= 12.45.0, \u003c 12.68.0"
},
{
"status": "affected",
"version": "\u003e= 13.0.0, \u003c 13.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:45:31.465Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362"
},
{
"name": "https://github.com/laravel/framework/pull/61322",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laravel/framework/pull/61322"
},
{
"name": "https://github.com/laravel/framework/pull/61323",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laravel/framework/pull/61323"
},
{
"name": "https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e"
},
{
"name": "https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8"
},
{
"name": "https://github.com/laravel/framework/releases/tag/v12.68.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laravel/framework/releases/tag/v12.68.0"
},
{
"name": "https://github.com/laravel/framework/releases/tag/v13.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laravel/framework/releases/tag/v13.27.0"
}
],
"source": {
"advisory": "GHSA-5wcm-3v2w-8362",
"discovery": "UNKNOWN"
},
"title": "Laravel relationship inclusion can trigger unauthorized data destruction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114508",
"datePublished": "2026-10-21T21:45:31.465Z",
"dateReserved": "2026-10-21T16:15:06.492Z",
"dateUpdated": "2026-10-23T21:18:11.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112145 (GCVE-0-2026-112145)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:45 – Updated: 2026-10-22 02:43
VLAI
EPSS
VEX
Title
speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code
Summary
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:42 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422250 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422250/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112145 | third-party-advisory |
| https://vuldb.com/submit/1013214 | third-party-advisory |
| https://github.com/speaches-ai/speaches/issues/679 | issue-tracking |
| https://github.com/user-attachments/files/3302860… | exploit |
| https://github.com/speaches-ai/speaches/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| speaches-ai | speaches |
Affected:
0.9.0-rc.0
Affected: 0.9.0-rc.1 Affected: 0.9.0-rc.2 Affected: 0.9.0-rc.3 cpe:2.3:a:speaches-ai:speaches:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112145",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:42:54.533575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:43:07.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:speaches-ai:speaches:*:*:*:*:*:*:*:*"
],
"modules": [
"Pyannote Diarization Model Loading"
],
"product": "speaches",
"vendor": "speaches-ai",
"versions": [
{
"status": "affected",
"version": "0.9.0-rc.0"
},
{
"status": "affected",
"version": "0.9.0-rc.1"
},
{
"status": "affected",
"version": "0.9.0-rc.2"
},
{
"status": "affected",
"version": "0.9.0-rc.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "Use of Externally-Controlled Input to Select Classes or Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:45:17.561Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422250 | speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422250"
},
{
"name": "VDB-422250 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422250/cti"
},
{
"name": "CVE-2026-112145 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112145"
},
{
"name": "Submit #1013214 | speaches-ai Speaches git master 2026-04-18 (commit 993994f) Unsafe Reflection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1013214"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/speaches-ai/speaches/issues/679"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33028601/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/speaches-ai/speaches/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:31:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112145",
"datePublished": "2026-10-19T13:45:17.561Z",
"dateReserved": "2026-10-19T05:26:01.076Z",
"dateUpdated": "2026-10-22T02:43:07.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112075 (GCVE-0-2026-112075)
Vulnerability from cvelistv5 – Published: 2026-10-19 03:45 – Updated: 2026-10-19 16:36 X_Open Source
VLAI
EPSS
VEX
Title
unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
Summary
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code
Assigner
VulDB
CNA
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421754 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421754/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112075 | third-party-advisory |
| https://vuldb.com/submit/1009576 | third-party-advisory |
| https://github.com/unslothai/unsloth/issues/12419 | issue-tracking |
| https://github.com/unslothai/unsloth/pull/11560 | issue-trackingpatch |
| https://github.com/user-attachments/files/3290831… | exploit |
| https://github.com/unslothai/unsloth/commit/de801… | patch |
| https://github.com/unslothai/unsloth/releases/tag… | patch |
| https://github.com/unslothai/unsloth/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112075",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:35.739324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:42.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:unslothai:unsloth:*:*:*:*:*:*:*:*"
],
"product": "unsloth",
"vendor": "unslothai",
"versions": [
{
"status": "affected",
"version": "0.1.501-beta"
},
{
"status": "unaffected",
"version": "0.1.902-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck99 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "Use of Externally-Controlled Input to Select Classes or Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T03:45:20.785Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421754 | unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421754"
},
{
"name": "VDB-421754 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421754/cti"
},
{
"name": "CVE-2026-112075 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112075"
},
{
"name": "Submit #1009576 | Unsloth AI Unsloth up to 2026.9.11 (commit de801746386a53a0cb26216e715a0af863b76ad9) Unsafe Reflection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009576"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth/issues/12419"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/unslothai/unsloth/pull/11560"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32908312/poc.zip"
},
{
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/unslothai/unsloth/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T15:51:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112075",
"datePublished": "2026-10-19T03:45:20.785Z",
"dateReserved": "2026-10-18T13:46:46.184Z",
"dateUpdated": "2026-10-19T16:36:42.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111851 (GCVE-0-2026-111851)
Vulnerability from cvelistv5 – Published: 2026-10-22 08:00 – Updated: 2026-10-22 10:56 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability
Summary
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 10:48 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WProyal | Royal Elementor Addons |
Affected:
0 , ≤ 1.7.1068
(custom)
|
Date Public
2026-10-20 07:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T10:48:03.878887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:56:14.204Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "royal-elementor-addons",
"product": "Royal Elementor Addons",
"vendor": "WProyal",
"versions": [
{
"changes": [
{
"at": "1.7.1069",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.1068",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Intrudify | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-20T07:22:41.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.\u003cp\u003eThis issue affects Royal Elementor Addons: from n/a through 1.7.1068.\u003c/p\u003e"
}
],
"value": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T08:00:50.041Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1068-arbitrary-code-execution-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Royal Elementor Addons plugin to the latest available version (at least 1.7.1069)."
}
],
"value": "Update the WordPress Royal Elementor Addons plugin to the latest available version (at least 1.7.1069)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Royal Elementor Addons plugin \u003c= 1.7.1068 - Arbitrary Code Execution vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-111851",
"datePublished": "2026-10-22T08:00:50.041Z",
"dateReserved": "2026-10-17T00:17:57.462Z",
"dateUpdated": "2026-10-22T10:56:14.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111440 (GCVE-0-2026-111440)
Vulnerability from cvelistv5 – Published: 2026-10-19 03:55 – Updated: 2026-10-19 17:39
VLAI
EPSS
VEX
Title
JDBC LogFactory 任意类加载/构造导致潜在 RCE
Summary
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。
此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:39 UTC
CWE
- CWE-470 - Use of Externally-Controlled input to select classes or code ('unsafe reflection')
Assigner
openGauss
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-connector-jdbc |
Unaffected:
7.0.0-LTS
Affected: 1.0.0, 1.0.1, 1.1.0 Affected: 2.0.0, 2.1.0 Affected: 3.0.0-3.0.5 Affected: 3.1.0-3.1.1 Affected: 5.0.0-5.0.3 Affected: 5.1.0 Affected: 5.0.0-RC1 Affected: 6.0.0-RC1 Affected: 6.0.0-6.0.6 Affected: 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:39:30.858779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:39:59.272Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
"defaultStatus": "unaffected",
"platforms": [
"openEuler",
"Centos"
],
"product": "openGauss-connector-jdbc",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
},
{
"status": "affected",
"version": "1.0.0, 1.0.1, 1.1.0"
},
{
"status": "affected",
"version": "2.0.0, 2.1.0"
},
{
"status": "affected",
"version": "3.0.0-3.0.5"
},
{
"status": "affected",
"version": "3.1.0-3.1.1"
},
{
"status": "affected",
"version": "5.0.0-5.0.3"
},
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-RC1"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
},
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u5728 openGauss-connector-jdbc \u7684 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java \u4e2d\uff0cLogFactory \u6839\u636e JDBC \u8fde\u63a5\u53c2\u6570\u4e2d\u7684 logger \u7c7b\u540d\u8c03\u7528 Class.forName \u52a0\u8f7d\u7c7b\u540e\uff0c\u76f4\u63a5\u53cd\u5c04\u8c03\u7528\u4ee5 String \u4e3a\u53c2\u6570\u7684\u6784\u9020\u51fd\u6570\uff0c\u518d\u8f6c\u6362\u4e3a Log\u3002\u7f3a\u5c11 asSubclass(Log.class) \u6821\u9a8c\uff0c\u975e Log \u5b9e\u73b0\u7c7b\u4e5f\u4f1a\u5728\u7c7b\u578b\u68c0\u67e5\u524d\u88ab\u5b9e\u4f8b\u5316\u3002\u56e0\u6b64\uff0c\u5f53\u653b\u51fb\u8005\u53ef\u63a7\u5236 JDBC URL \u6216\u8fde\u63a5\u5c5e\u6027\u4e2d\u7684 logger \u7c7b\u540d\uff0c\u4e14\u5ba2\u6237\u7aef classpath \u4e2d\u5b58\u5728\u53ef\u88ab\u52a0\u8f7d\u7684\u7c7b\u65f6\uff0c\u53ef\u80fd\u5728\u5ba2\u6237\u7aef\u89e6\u53d1\u975e\u9884\u671f\u7684\u7c7b\u52a0\u8f7d\u4e0e\u6784\u9020\u526f\u4f5c\u7528\u3002\u003cbr\u003e\u003cbr\u003e\u6b64\u6f0f\u6d1e\u81ea JDBC 1.1.0\u5f15\u5165\uff0c\u5f71\u54cd 1.1.0 \u53ca\u4e4b\u540e\u7684 2.x\u30013.x\u30015.x\u30016.x \u5404\u7248\u672c\u53ca\u8865\u4e01\uff08\u542b 6.0.0 \u5206\u652f\u6700\u65b0 6.0.6\uff09\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\uff0c\u5e76\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\u3002\u4fee\u590d\u5728 Class.forName \u4e4b\u540e\u5148\u6267\u884c asSubclass(Log.class)\uff0c\u4ec5\u5141\u8bb8 Log \u5b50\u7c7b\u8fdb\u5165\u6784\u9020\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423\u3002"
}
],
"value": "\u5728 openGauss-connector-jdbc \u7684 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java \u4e2d\uff0cLogFactory \u6839\u636e JDBC \u8fde\u63a5\u53c2\u6570\u4e2d\u7684 logger \u7c7b\u540d\u8c03\u7528 Class.forName \u52a0\u8f7d\u7c7b\u540e\uff0c\u76f4\u63a5\u53cd\u5c04\u8c03\u7528\u4ee5 String \u4e3a\u53c2\u6570\u7684\u6784\u9020\u51fd\u6570\uff0c\u518d\u8f6c\u6362\u4e3a Log\u3002\u7f3a\u5c11 asSubclass(Log.class) \u6821\u9a8c\uff0c\u975e Log \u5b9e\u73b0\u7c7b\u4e5f\u4f1a\u5728\u7c7b\u578b\u68c0\u67e5\u524d\u88ab\u5b9e\u4f8b\u5316\u3002\u56e0\u6b64\uff0c\u5f53\u653b\u51fb\u8005\u53ef\u63a7\u5236 JDBC URL \u6216\u8fde\u63a5\u5c5e\u6027\u4e2d\u7684 logger \u7c7b\u540d\uff0c\u4e14\u5ba2\u6237\u7aef classpath \u4e2d\u5b58\u5728\u53ef\u88ab\u52a0\u8f7d\u7684\u7c7b\u65f6\uff0c\u53ef\u80fd\u5728\u5ba2\u6237\u7aef\u89e6\u53d1\u975e\u9884\u671f\u7684\u7c7b\u52a0\u8f7d\u4e0e\u6784\u9020\u526f\u4f5c\u7528\u3002\n\n\u6b64\u6f0f\u6d1e\u81ea JDBC 1.1.0\u5f15\u5165\uff0c\u5f71\u54cd 1.1.0 \u53ca\u4e4b\u540e\u7684 2.x\u30013.x\u30015.x\u30016.x \u5404\u7248\u672c\u53ca\u8865\u4e01\uff08\u542b 6.0.0 \u5206\u652f\u6700\u65b0 6.0.6\uff09\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\uff0c\u5e76\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\u3002\u4fee\u590d\u5728 Class.forName \u4e4b\u540e\u5148\u6267\u884c asSubclass(Log.class)\uff0c\u4ec5\u5141\u8bb8 Log \u5b50\u7c7b\u8fdb\u5165\u6784\u9020\u3002\u4fee\u590dpr\u89c1https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423\u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-138",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-138 Reflection Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470 Use of Externally-Controlled input to select classes or code (\u0027unsafe reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:12:17.254Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "JDBC LogFactory \u4efb\u610f\u7c7b\u52a0\u8f7d/\u6784\u9020\u5bfc\u81f4\u6f5c\u5728 RCE",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111440",
"datePublished": "2026-10-19T03:55:19.107Z",
"dateReserved": "2026-10-16T03:04:57.224Z",
"dateUpdated": "2026-10-19T17:39:59.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108099 (GCVE-0-2026-108099)
Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-11-06 16:00
VLAI
EPSS
VEX
Title
Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218
Summary
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:00 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Assigner
drupal
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | Entity List |
Affected:
0.0.0 , < 3.0.10
(semver)
|
Date Public
2026-10-14 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-108099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:00:45.254116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:00:50.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/entity_list",
"product": "Entity List",
"repo": "https://git.drupalcode.org/project/entity_list",
"vendor": "Drupal",
"versions": [
{
"lessThan": "3.0.10",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lee Rowlands (larowlan)"
},
{
"lang": "en",
"type": "finder",
"value": "Dave Long (longwave)"
},
{
"lang": "en",
"type": "finder",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "finder",
"value": "Octavio Galland (ogalland-tob)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "catch (catch)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lee Rowlands (larowlan)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dave Long (longwave)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Marc-Antoine MARTY (martygraphie)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jess (xjm)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Bram Driesen (bramdriesen)"
},
{
"lang": "en",
"type": "coordinator",
"value": "catch (catch)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Damien McKenna"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Tim Hestenes Lehnen (hestenet)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Lee Rowlands (larowlan)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Dave Long (longwave)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Pierre Rudloff (prudloff)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jess (xjm)"
}
],
"datePublic": "2026-10-14T17:26:14.000Z",
"descriptions": [
{
"lang": "en",
"value": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10."
}
],
"impacts": [
{
"capecId": "CAPEC-138",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-138 Reflection Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:09:50.302Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-218"
}
],
"title": "Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-108099",
"datePublished": "2026-10-30T03:09:50.302Z",
"dateReserved": "2026-10-09T13:40:16.541Z",
"dateUpdated": "2026-11-06T16:00:50.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108097 (GCVE-0-2026-108097)
Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-11-06 16:05
VLAI
EPSS
VEX
Title
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Summary
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:05 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Assigner
drupal
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | Drupal core |
Affected:
8.9.0 , < 10.6.19
(semver)
Affected: 11.0.0 , < 11.3.19 (semver) Affected: 11.4.0 , < 11.4.10 (semver) Affected: 12.0.0-alpha1 , < 12.0.0-beta2 (semver) |
Date Public
2026-10-14 16:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-108097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:05:53.331783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:05:59.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/drupal",
"product": "Drupal core",
"repo": "https://git.drupalcode.org/project/drupal",
"vendor": "Drupal",
"versions": [
{
"lessThan": "10.6.19",
"status": "affected",
"version": "8.9.0",
"versionType": "semver"
},
{
"lessThan": "11.3.19",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThan": "11.4.10",
"status": "affected",
"version": "11.4.0",
"versionType": "semver"
},
{
"lessThan": "12.0.0-beta2",
"status": "affected",
"version": "12.0.0-alpha1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "finder",
"value": "Octavio Galland (ogalland-tob)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "catch (catch)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lee Rowlands (larowlan)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dave Long (longwave)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jess (xjm)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Bram Driesen (bramdriesen)"
},
{
"lang": "en",
"type": "coordinator",
"value": "catch (catch)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Tim Hestenes Lehnen (hestenet)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Lee Rowlands (larowlan)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Dave Long (longwave)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Pierre Rudloff (prudloff)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jess (xjm)"
}
],
"datePublic": "2026-10-14T16:10:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2."
}
],
"impacts": [
{
"capecId": "CAPEC-138",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-138 Reflection Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:09:55.043Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-core-2026-014"
}
],
"title": "Drupal core - Critical - Remote code execution - SA-CORE-2026-014"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-108097",
"datePublished": "2026-10-30T03:09:55.043Z",
"dateReserved": "2026-10-09T13:40:16.541Z",
"dateUpdated": "2026-11-06T16:05:59.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106510 (GCVE-0-2026-106510)
Vulnerability from cvelistv5 – Published: 2026-10-07 14:36 – Updated: 2026-10-07 17:15
VLAI
EPSS
VEX
Title
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Summary
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:13 UTC
CWE
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/backstage/backstage/security/a… | x_refsource_CONFIRM |
| https://github.com/backstage/backstage/commit/02c… | x_refsource_MISC |
| https://github.com/backstage/backstage/commit/a90… | x_refsource_MISC |
| https://github.com/backstage/backstage/releases/t… | x_refsource_MISC |
| https://github.com/backstage/backstage/releases/t… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| backstage | backstage |
Affected:
< 1.50.5
Affected: >= 1.51.0-next.0, < 1.54.6 |
|
| @backstage | plugin-techdocs-node |
Affected:
< 1.14.6
Affected: >= 1.15.0, < 1.15.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106510",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:13:13.346488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:15:43.410Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "backstage",
"vendor": "backstage",
"versions": [
{
"status": "affected",
"version": "\u003c 1.50.5"
},
{
"status": "affected",
"version": "\u003e= 1.51.0-next.0, \u003c 1.54.6"
}
]
},
{
"product": "plugin-techdocs-node",
"vendor": "@backstage",
"versions": [
{
"status": "affected",
"version": "\u003c 1.14.6"
},
{
"status": "affected",
"version": "\u003e= 1.15.0, \u003c 1.15.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-183",
"description": "CWE-183: Permissive List of Allowed Inputs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:36:53.929Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv"
},
{
"name": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb"
},
{
"name": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d"
},
{
"name": "https://github.com/backstage/backstage/releases/tag/v1.50.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"
},
{
"name": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
}
],
"source": {
"advisory": "GHSA-4488-j8vj-vqqv",
"discovery": "UNKNOWN"
},
"title": "Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106510",
"datePublished": "2026-10-07T14:36:53.929Z",
"dateReserved": "2026-10-06T18:46:47.767Z",
"dateUpdated": "2026-10-07T17:15:43.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106440 (GCVE-0-2026-106440)
Vulnerability from cvelistv5 – Published: 2026-10-06 18:51 – Updated: 2026-10-09 01:39
VLAI
EPSS
VEX
Title
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
Summary
Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() is a trusted-input lookup helper and does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep configuration or command-line overrides can select importable Python code for execution with the application's privileges, including bypassing a trusted execution whitelist on affected Hydra 1.4 development releases. This issue is fixed in versions 1.3.0 and 1.4.0.dev10.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 01:39 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hydra-ecosystem/hydra/security… | x_refsource_CONFIRM |
| https://github.com/hydra-ecosystem/hydra/commit/0… | x_refsource_MISC |
| https://github.com/hydra-ecosystem/hydra/commit/4… | x_refsource_MISC |
| https://github.com/hydra-ecosystem/hydra/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hydra-ecosystem | hydra |
Affected:
>= 1.2.0, < 1.3.0
Affected: >= 1.4.0.dev4, < 1.4.0.dev10 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T01:39:29.434404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T01:39:38.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hydra",
"vendor": "hydra-ecosystem",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.2.0, \u003c 1.3.0"
},
{
"status": "affected",
"version": "\u003e= 1.4.0.dev4, \u003c 1.4.0.dev10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() is a trusted-input lookup helper and does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep configuration or command-line overrides can select importable Python code for execution with the application\u0027s privileges, including bypassing a trusted execution whitelist on affected Hydra 1.4 development releases. This issue is fixed in versions 1.3.0 and 1.4.0.dev10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:51:37.549Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56"
},
{
"name": "https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6"
},
{
"name": "https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168"
},
{
"name": "https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7"
}
],
"source": {
"advisory": "GHSA-5jjj-9xc3-rm56",
"discovery": "UNKNOWN"
},
"title": "Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106440",
"datePublished": "2026-10-06T18:51:37.549Z",
"dateReserved": "2026-10-06T16:49:40.590Z",
"dateUpdated": "2026-10-09T01:39:38.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106439 (GCVE-0-2026-106439)
Vulnerability from cvelistv5 – Published: 2026-10-06 18:49 – Updated: 2026-10-06 19:48
VLAI
EPSS
VEX
Title
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Summary
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:48 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hydra-ecosystem/hydra/security… | x_refsource_CONFIRM |
| https://github.com/hydra-ecosystem/hydra/commit/0… | x_refsource_MISC |
| https://github.com/hydra-ecosystem/hydra/commit/4… | x_refsource_MISC |
| https://github.com/hydra-ecosystem/hydra/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hydra-ecosystem | hydra |
Affected:
>= 1.3.4, < 1.3.7
Affected: >= 1.4.0.dev4, < 1.4.0.dev10 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106439",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:48:26.207340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:48:45.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hydra",
"vendor": "hydra-ecosystem",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.3.4, \u003c 1.3.7"
},
{
"status": "affected",
"version": "\u003e= 1.4.0.dev4, \u003c 1.4.0.dev10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application\u0027s privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:49:12.110Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4"
},
{
"name": "https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6"
},
{
"name": "https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168"
},
{
"name": "https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7"
}
],
"source": {
"advisory": "GHSA-mwj6-rfh8-7qf4",
"discovery": "UNKNOWN"
},
"title": "Hydra: Mutable instantiate policy sets allow target blocklist bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106439",
"datePublished": "2026-10-06T18:49:12.110Z",
"dateReserved": "2026-10-06T16:49:40.590Z",
"dateUpdated": "2026-10-06T19:48:45.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Refactor your code to avoid using reflection.
Mitigation
Architecture and Design
Do not use user-controlled inputs to select and load classes or code.
Mitigation
Implementation
Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.
CAPEC-138: Reflection Injection
An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application.