Tag
#Arbitrary Code Execution
Understanding and Defending Against Arbitrary Code Execution in Prompty
This educational analysis covers a critical vulnerability in the Prompty loader, which allows for arbitrary JavaScript execution via JavaScript frontmatter in TypeScript. The vulnerability, tracked as CVE-2026-53597, affects the `@prompty/core` package in its v2 prerelease line. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, and defensive strategies.
Critical Vulnerability in Keras: Arbitrary Code Execution via Deserialization
A critical vulnerability (CVE-2026-12481) in Keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. This vulnerability has a CVSS score of 8.8 and can be exploited to achieve OS-level code execution. Affected users must update to a patched version to mitigate this risk.
CVE-2026-48307: Reflected Cross-Site Scripting (XSS) in Adobe ColdFusion
A reflected Cross-Site Scripting (XSS) vulnerability exists in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. This requires user interaction, as a victim must open a malicious link.
Critical Vulnerability in Jenkins OWASP ZAP Plugin Allows Arbitrary Code Execution
A critical vulnerability (CVE-2026-57301) with a CVSS score of 8.8 has been discovered in the Jenkins OWASP ZAP Plugin, affecting versions 1.0.7 and earlier. This vulnerability allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller. Immediate action is required to update to a patched version.
Critical PHP Code Injection Vulnerability in Revive Adserver (CVE-2026-34916)
A low-privileged user can inject malicious PHP code into Revive Adserver 6.0.6 and earlier, allowing for arbitrary code execution during banner delivery. This vulnerability has a CVSS score of 8.8 and requires immediate attention. Update Revive Adserver to version 6.0.7 or later to mitigate this vulnerability.
PDM Vulnerability Allows Arbitrary Code Execution
A vulnerability in PDM (Python package manager) allows arbitrary code execution with the privileges of the user running `pdm` from an untrusted repository checkout.