Skip to content
Threat Feed
Subscribe

Tag

Configuration-Injection

3 briefs RSS
critical advisory

Logging Operator Configuration Injection Leading to RCE

The Logging operator is vulnerable to remote code execution due to improper input sanitization in Fluentd configuration rendering, allowing authenticated users to inject arbitrary configuration blocks via CRDs.

logging-operator remote-code-execution kubernetes configuration-injection cve-2026-54680
1t
high advisory

Coder SSH Config Injection Vulnerability (CVE-2026-55427)

A malicious or compromised Coder server can exploit CVE-2026-55427 to inject unsanitized SSH configuration values via `coder config-ssh` into developer workstations, enabling arbitrary code execution on client machines.

Coder +3 ssh configuration-injection rce supply-chain developer-tools vulnerability
1t
critical advisory

CVE-2024-58351: Flowise Remote Code Execution via Configuration Injection

Flowise versions before 2.1.4 are critically vulnerable to configuration injection (CVE-2024-58351) via the `overrideConfig` option in both its frontend web integration and backend Prediction API, which, due to a bypassable `vm2` sandbox, allows attackers to achieve remote code execution, sandbox escape, denial of service, server-side request forgery, prompt injection, and server variable/data exfiltration.

Flowise web-vulnerability rce sandbox-escape node.js configuration-injection
2r 7t