Skip to content
Threat Feed
Subscribe

Tag

Cli-Tool

3 briefs RSS
high advisory

Arbitrary Command Execution in aider via Malicious Configuration Files

The aider CLI tool is vulnerable to arbitrary command execution because it automatically executes shell commands defined in a .aider.conf.yml file located in the root of a Git repository upon startup.

aider vulnerability remote-code-execution cli-tool
1r 1t 1c
high advisory

@wakaru/cli Arbitrary File Write Vulnerability CVE-2026-54545

@wakaru/cli versions from 1.0.0 up to, but not including, 1.4.0 are vulnerable to arbitrary file write due to a path traversal flaw when unpacking a crafted JavaScript bundle using the `--unpack` command, where specially formatted filenames can bypass sanitization and lead to remote code execution.

@wakaru/cli arbitrary-file-write path-traversal code-execution javascript cli-tool
2t
critical advisory

gemini-mcp-tool Vulnerable to OS Command Injection and File Exfiltration (CVE-2026-0755)

A critical vulnerability, CVE-2026-0755, in npm's gemini-mcp-tool package allows for OS command injection on Windows systems due to improper handling of unquoted cmd.exe metacharacters, and arbitrary local file exfiltration via the @file parser when processing untrusted prompt input, leading to potential remote code execution and sensitive data compromise.

gemini-mcp-tool command-injection file-exfiltration npm cli-tool web-vulnerability
2r 3t