deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9028
Published: 2025-08-15
Description: A flaw has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /adphar.php. Executing manipulation of the argument phuname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-74
References: https://code-projects.org/; https://github.com/Jackie1732/CVE/issues/3; https://vuldb.com/?ctiid.320093
CVE: CVE-2025-9046
Published: 2025-08-15
Description: A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub_46A2AC of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/ZZ2266/.github.io/blob/main/AC20/formSetMacFilterCfg/readme.md; https://github.com/ZZ2266/.github.io/blob/main/AC20/formSetMacFilterCfg/readme.md#poc-python-exploit-script; https://vuldb.com/?ctiid.320267
CVE: CVE-2025-9047
Published: 2025-08-15
Description: A vulnerability has been found in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /visitor_out.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guoma-book/CVE/issues/2; https://vuldb.com/?ctiid.320268; https://vuldb.com/?id.320268
CVE: CVE-2025-1929
Published: 2025-08-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve Risk Yönetimi Yazılımı allows SQL Injection, CAPEC - 7 - Blind SQL Injection.This issue affects Reel Sektör Hazine ve Risk Yönetimi Yazılımı: through 1.0.0.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0198
CVE: CVE-2025-54473
Published: 2025-08-15
Description: An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.
CWE: CWE-434
References: https://phoca.cz/
CVE: CVE-2025-54474
Published: 2025-08-15
Description: A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.
CWE: CWE-89
References: https://dj-extensions.com/
CVE: CVE-2025-54475
Published: 2025-08-15
Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands.
CWE: CWE-89
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-54475; https://joomsky.com/js-jobs-joomla/
CVE: CVE-2025-9050
Published: 2025-08-15
Description: A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /addcategory.php. The manipulation of the argument t1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guoma-book/CVE/issues/6; https://vuldb.com/?ctiid.320269; https://vuldb.com/?id.320269
CVE: CVE-2025-9051
Published: 2025-08-15
Description: A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory.php. The manipulation of the argument t1 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guoma-book/CVE/issues/7; https://vuldb.com/?ctiid.320270; https://vuldb.com/?id.320270
CVE: CVE-2025-9052
Published: 2025-08-15
Description: A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. The manipulation of the argument s1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/guoma-book/CVE/issues/8; https://vuldb.com/?ctiid.320271; https://vuldb.com/?id.320271
CVE: CVE-2025-9053
Published: 2025-08-15
Description: A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/guoma-book/CVE/issues/9; https://vuldb.com/?ctiid.320272; https://vuldb.com/?id.320272
CVE: CVE-2024-12573
Published: 2025-08-15
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-24752 Reason: This candidate is a reservation duplicate of CVE-2025-24752. Notes: All CVE users should reference CVE-2025-24752 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-24975
Published: 2025-08-15
Description: Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal to 0. If connections stored in ExtConnPool are not verified for presence and suitability of the CryptCallback interface is used when created versus what is available could result in a segfault in the server process. Encrypted databases, accessed by execute statement on external, may be accessed later by an attachment missing a key to that database. In a case when execute statement are chained, segfault may happen. Additionally, the segfault may affect unencrypted databases. This issue has been patched in snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 and point releases 4.0.6 and 5.0.2. A workaround for this issue involves setting ExtConnPoolSize equal to 0 in firebird.conf.
CVSS Score: 7.1 (HIGH)
CWE: CWE-754
References: https://github.com/FirebirdSQL/firebird/commit/658abd20449f72097fbbce57e8e6ae42ff837fb6; https://github.com/FirebirdSQL/firebird/issues/8429; https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-fx9r-rj68-7p69
CVE: CVE-2025-54466
Published: 2025-08-15
Description: Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.

This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.

Even unauthenticated attackers can exploit this vulnerability.


Users are recommended to upgrade to version 24.09.02, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://issues.apache.org/jira/browse/OFBIZ-13276; https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915; https://ofbiz.apache.org/download.html
CVE: CVE-2025-54989
Published: 2025-08-15
Description: Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/FirebirdSQL/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25; https://github.com/FirebirdSQL/firebird/issues/8554; https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7qp6-hqxj-pjjp
CVE: CVE-2025-55203
Published: 2025-08-15
Description: Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other users’ browsers. The description_html field is not properly sanitized or escaped. An attacker can submit crafted JavaScript payloads that are saved in the application’s database. When another user views the affected content, the injected code executes in their browser, running in the application’s context and bypassing standard security protections. Successful exploitation can lead to session hijacking, theft of sensitive information, or forced redirection to malicious sites. The vulnerability can also be chained with CSRF attacks to perform unauthorized actions, or leveraged to distribute malware and exploit additional browser vulnerabilities. This issue has been patched in version 0.28.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1lQzQJ9Eun6xmcxyyAkr5ORyIrfw9ys5w/view?usp=sharing; https://github.com/makeplane/plane/security/advisories/GHSA-rwjc-xhh3-m9m9
CVE: CVE-2025-5046
Published: 2025-08-15
Description: A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
CVE: CVE-2025-5047
Published: 2025-08-15
Description: A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
CVE: CVE-2025-5048
Published: 2025-08-15
Description: A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
CVE: CVE-2025-49432
Published: 2025-08-15
Description: Missing Authorization vulnerability in FWDesign Ultimate Video Player fwduvp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Video Player: from n/a through <= 10.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fwduvp/vulnerability/wordpress-ultimate-video-player-plugin-plugin-10-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49897
Published: 2025-08-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/vertical-scroll-slideshow-gallery-v2/vulnerability/wordpress-vertical-scroll-slideshow-gallery-v2-plugin-9-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49898
Published: 2025-08-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xolluteon Dropshix allows DOM-Based XSS.This issue affects Dropshix: from n/a through 4.0.14.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/dropshipping-xox/vulnerability/wordpress-dropshix-plugin-4-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-55207
Published: 2025-08-15
Description: Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios prior to version 9.4.1. Astro 5.12.8 addressed CVE-2025-54793 where https://example.com//astro.build/press would redirect to the external origin //astro.build/press. However, with the Node deployment adapter in standalone mode and trailingSlash set to "always" in the Astro configuration, https://example.com//astro.build/press still redirects to //astro.build/press. This affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks. This issue has been patched in version 9.4.1.
CWE: CWE-601
References: https://github.com/withastro/astro/commit/5fc3c599cacb0172cc7d8e1202a5f2e8685d7ef2; https://github.com/withastro/astro/security/advisories/GHSA-9x9c-ghc5-jhw9
CVE: CVE-2025-8066
Published: 2025-08-15
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bunkerity Bunker Web on Linux allows Phishing.This issue affects Bunker Web: 1.6.2.
CWE: CWE-601
References: https://fluidattacks.com/advisories/cypress; https://github.com/bunkerity/bunkerweb; https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.4
CVE: CVE-2025-7961
Published: 2025-08-15
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0.
CWE: CWE-94
References: http://wulkano.com/; https://fluidattacks.com/advisories/cafrune; https://getkap.co/
CVE: CVE-2025-8092
Published: 2025-08-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-092
CVE: CVE-2025-8361
Published: 2025-08-15
Description: Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.This issue affects Config Pages: from 0.0.0 before 2.18.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-962, CWE-862
References: https://www.drupal.org/sa-contrib-2025-093
CVE: CVE-2025-8362
Published: 2025-08-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-094
CVE: CVE-2025-8675
Published: 2025-08-15
Description: Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://www.drupal.org/sa-contrib-2025-095
CVE: CVE-2025-8995
Published: 2025-08-15
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://www.drupal.org/sa-contrib-2025-096
CVE: CVE-2025-8996
Published: 2025-08-15
Description: Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-097
CVE: CVE-2025-9060
Published: 2025-08-15
Description: A vulnerability has been found in the  MSoft MFlash

 application that allows 
execution of arbitrary code on the server. The issue occurs in the 
integration configuration functionality that is only available to 
MFlash


 administrators. The vulnerability is related to insufficient validation
 of parameters when setting up security components.

This issue affects MFlash v. 8.0 and possibly others. To mitigate apply 8.2-653 hotfix 11.06.2025 and above.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://github.com/klsecservices/Advisories/blob/master/K-MSoft-2025-002.md
CVE: CVE-2025-55285
Published: 2025-08-15
Description: @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.
CVSS Score: 2.6 (LOW)
CWE: CWE-532
References: https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e; https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7
CVE: CVE-2025-43490
Published: 2025-08-15
Description: A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.
CWE: CWE-59
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]3393-16/hpsbhf04044
CVE: CVE-2025-36088
Published: 2025-08-15
Description: IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7242263
CVE: CVE-2025-44201
Published: 2025-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-8959
Published: 2025-08-15
Description: HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242
CVE: CVE-2025-43201
Published: 2025-08-15
Description: This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's credentials.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/124156
CVE: CVE-2025-52618
Published: 2025-08-15
Description: HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability.  The vulnerability allows potential attackers to manipulate SQL queries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE: CVE-2025-52619
Published: 2025-08-15
Description: HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure.  Under certain conditions, error messages disclose sensitive version information about the underlying platform.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE: CVE-2025-52620
Published: 2025-08-15
Description: HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability.  The image upload functionality inadequately validated the submitted image format.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE: CVE-2025-52621
Published: 2025-08-15
Description: HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning.   The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE: CVE-2017-20199
Published: 2025-08-16
Description: A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 1.0.1 addresses this issue. The patch is identified as 89. Upgrading the affected component is recommended. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.1 (LOW)
CWE: CWE-266, CWE-284
References: https://github.com/buttercup/buttercup-browser-extension/issues/92; https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-358449755; https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-372991430
CVE: CVE-2025-55286
Published: 2025-08-16
Description: z2d is a pure Zig 2D graphics library. z2d v0.7.0 released with a new multi-sample anti-aliasing (MSAA) method, which uses a new buffering mechanism for storing coverage data. This differs from the standard alpha mask surface used for the previous super-sample anti-aliasing (SSAA) method. Under certain circumstances where the path being drawn existed in whole or partly outside of the rendering surface, incorrect bounding could cause out-of-bounds access within the coverage buffer. This affects the higher-level drawing operations, such as Context.fill, Context.stroke, painter.fill, and painter.stroke, when either the .default or .multisample_4x anti-aliasing modes were used. .supersample_4x was not affected, nor was drawing without anti-aliasing. In non-safe optimization modes (consumers compiling with ReleaseFast or ReleaseSmall), this could potentially lead to invalid memory accesses or corruption. z2d v0.7.1 fixes this issue, and it's recommended to upgrade to v0.7.1, or, given the small period of time v0.7.0 has been released, use v0.7.1 immediately, skipping v0.7.0.
CWE: CWE-119, CWE-122
References: https://github.com/vancluever/z2d/commit/93e45d36af53cda0d7f454ed8440713b7ac155b6; https://github.com/vancluever/z2d/pull/137; https://github.com/vancluever/z2d/security/advisories/GHSA-2vq8-cp8r-vcf3
CVE: CVE-2025-55284
Published: 2025-08-16
Description: Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation due to an overly broad allowlist of safe commands. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-x5gv-jw7f-j6xj