By weakness (CWE)

CWE-88: related vulnerabilities

CVEs classified under CWE-88. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2024-52011HIGH 8.3

  CVE-2024-52011 is a command injection vulnerability in the launch-editor library, a Node.js utility that opens files in text editors with specified line numbers. Before version 2.9.0, the library failed to properly sanitize filename input on Windows systems, allowing an attacker to inject and execute arbitrary commands by crafting a malicious filename. An attacker would need to trick a user into opening a specially crafted file—typically through a development workflow, build process, or IDE integration—to trigger code execution with the privileges of the affected user.

• CVE-2026-41013HIGH 8.1

  A flaw in how Cloud Foundry's Diego release handles SMB volume mounts allows a developer with basic access to a shared environment to bypass security restrictions and inject malicious mount commands. This could let them gain elevated privileges or circumvent security controls on multi-tenant systems where multiple teams share the same infrastructure.

• CVE-2026-11332HIGH 7.8

  A vulnerability in ansible-core allows attackers to execute arbitrary code on systems where users install malicious Ansible roles. The attack works by embedding hidden git commands in a role's dependency specification file. When a user runs the standard ansible-galaxy role install command to fetch a role, the injected git flags execute with the privileges of that user, potentially giving an attacker full control over the victim's machine.

• CVE-2026-48116HIGH 7.5

  AnythingLLM versions before 1.13.0 contain a command injection vulnerability in their filesystem search capability. When an authenticated user chats with the filesystem agent, an attacker can craft malicious search patterns that trick the underlying ripgrep tool into executing arbitrary commands on the server. The vulnerability exists because the application doesn't properly isolate user input before passing it to ripgrep, allowing an attacker to inject command-line flags that transform ripgrep into a command executor. Combined with AnythingLLM's file-writing capability, this creates a complete remote code execution path within the container.

• CVE-2026-49373HIGH 7.1

  JetBrains TeamCity versions prior to 2026.1 contain a remote code execution vulnerability accessible through the Perforce connection configuration interface. An authenticated user with permissions to modify Perforce settings can execute arbitrary code on the TeamCity server. This requires valid credentials and access to TeamCity's configuration features, but does not require user interaction or special system conditions once access is gained.