By weakness (CWE)
CWE-150: related vulnerabilities
CVEs classified under CWE-150. Understanding the weakness class helps prioritize systemic fixes over one-off patches.
7 published vulnerabilities
- CVE-2026-50637HIGH 8.2
Metrics::Any::Adapter::Statsd, a Perl library for sending metrics to StatsD servers, fails to sanitize metric names and values before transmission. An attacker can inject additional metrics into a single StatsD packet by embedding newlines and special control characters (colons, pipes) in metric data. This allows manipulation of monitoring data without authentication, potentially causing false alerts, hiding real issues, or poisoning observability systems that other services depend on. The vulnerability affects all versions before 0.04, which introduced input validation to block problematic characters.
- CVE-2026-54057HIGH 7.8
Kitty, a GPU-accelerated terminal emulator, contains a vulnerability in how it handles color control queries. When a user runs certain terminal commands, an attacker can inject malicious input—including newlines and shell commands—that kitty reflects back into the shell without filtering. This allows arbitrary command execution under the user's privileges. The flaw affects all versions before 0.47.3, which includes the fix.
- CVE-2026-46741HIGH 7.5
Etsy::StatsD, a Perl library used to send monitoring metrics to StatsD servers, fails to properly validate metric names and values before transmission. An attacker who controls data that flows into the application's metrics can inject malicious StatsD commands by embedding newlines, colons, or pipes—characters that have special meaning in the StatsD protocol. This allows injection of unauthorized metrics that could disrupt monitoring, mask real alerts, or degrade observability infrastructure.
- CVE-2026-49147HIGH 7.5
App::Ack, a popular command-line search utility for Perl, fails to sanitize terminal escape sequences embedded in filenames across multiple output modes. When a user or an automated process searches files with ack and a filename contains ANSI escape codes (such as color or cursor-movement sequences), those bytes pass directly to the terminal unsanitized. This can allow an attacker to manipulate terminal display, overwrite previous output, or inject malicious control sequences into downstream tools that consume ack's output. The vulnerability affects versions through 3.10.0, though a partial fix was introduced in 3.10.0 that addresses some—but not all—output paths.
- CVE-2026-50639MEDIUM 6.5
A Perl metrics reporting library fails to validate input containing special characters, allowing attackers to inject fake metrics into monitoring systems. The vulnerability affects Metrics::Any::Adapter::SignalFx versions before 0.04, which extends statsd protocol support but does not properly filter newlines and control characters in metric labels. An attacker could craft requests with embedded metric definitions to pollute monitoring data, potentially masking real system issues or triggering false alerts.
- CVE-2026-8722MEDIUM 6.5
A vulnerability in the Perl Net::Async::Statsd::Client library allows attackers to inject arbitrary metrics into statsd monitoring systems by exploiting insufficient input validation. Because the library fails to sanitize metric names for special characters (newlines, colons, and pipes), an attacker who controls metric input can inject additional monitoring data, potentially disrupting observability or falsifying application metrics.
- CVE-2026-46739MEDIUM 5.3
Net::Statsd is a Perl library used to send metrics to statsd monitoring servers. Versions before 0.13 fail to validate metric names and values, allowing an attacker to inject arbitrary statsd commands by crafting malicious metric input. If an application uses Net::Statsd to process untrusted data—such as user-supplied values or data from external APIs—an attacker can inject additional metrics into the monitoring stream, potentially corrupting metrics, creating false alerts, or degrading visibility into system health.