Skip to content
Threat Feed
Subscribe

Tag

Configuration-Injection

4 briefs RSS
medium advisory

CVE-2026-90937 Configuration Injection in Froxlor

Froxlor versions before 2.2.5 contain a vulnerability allowing authenticated users to inject arbitrary Nginx or Apache configuration directives via unvalidated newline characters in subdomain redirect URLs.

froxlor web-application-vulnerability configuration-injection server-hijacking
1t 1c
critical advisory

Logging Operator Configuration Injection Leading to RCE

The Logging operator is vulnerable to remote code execution due to improper input sanitization in Fluentd configuration rendering, allowing authenticated users to inject arbitrary configuration blocks via CRDs.

logging-operator remote-code-execution kubernetes configuration-injection cve-2026-54680
1t
high advisory

Coder SSH Config Injection Vulnerability (CVE-2026-55427)

A malicious or compromised Coder server can exploit CVE-2026-55427 to inject unsanitized SSH configuration values via `coder config-ssh` into developer workstations, enabling arbitrary code execution on client machines.

Coder +3 ssh configuration-injection rce supply-chain developer-tools vulnerability
1t
critical advisory

CVE-2024-58351: Flowise Remote Code Execution via Configuration Injection

Flowise versions before 2.1.4 are critically vulnerable to configuration injection (CVE-2024-58351) via the `overrideConfig` option in both its frontend web integration and backend Prediction API, which, due to a bypassable `vm2` sandbox, allows attackers to achieve remote code execution, sandbox escape, denial of service, server-side request forgery, prompt injection, and server variable/data exfiltration.

Flowise web-vulnerability rce sandbox-escape node.js configuration-injection
2r 7t