Loading story…
CVE-2026-54569 is a CVSS 9.8 critical vulnerability affecting SENAITE.CORE versions 2.0.0 through 2.6.0, the framework used by the SENAITE laboratory information management system. An unauthenticated attacker can combine missing authorization on state-changing @@API routes with unsafe evaluation of attacker-controlled record values: after obtaining the bika_setup object identifier through @@uuid, the attacker can submit a crafted value to /@@API/update and execute arbitrary Python in a Zope worker. The attack can expose or alter laboratory data, files, and accounts, and disrupt service availability.
SENAITE.CORE's 2.x fixes replace eval()-based record parsing with an ast.literal_eval-based parse_record_literal helper, preventing arbitrary-code execution through record literals. A separate authorization fix enforces the senaite.core: Access JSON API permission before update, update_many, remove, doActionFor, doActionFor_many, and getusers operations, blocking anonymous and under-privileged users from mutations and user enumeration. Organizations using affected versions should upgrade to a secure SENAITE.CORE release containing both fixes and verify that JSON API access is restricted.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-54569 was published as a CVSS 9.8 critical vulnerability affecting SENAITE.CORE 2.0.0 through 2.6.0. The advisory described an unauthenticated exploit chain combining unprotected JSON API routes with unsafe eval() of attacker-controlled record values, enabling code execution in a Zope worker.
SENAITE.CORE merged commit ef4b6d7 into the 2.x branch to enforce the AccessJSONAPI permission on state-changing JSON API routes and the getusers enumeration route. The CWE-862 fix blocks anonymous and Member-level callers before mutations or user lookup occur.
SENAITE.CORE merged commit a24d65e into the 2.x branch, replacing eval()-based parsing of record values with an ast.literal_eval-based helper. The change added tests showing code-execution payloads are rejected without creating a filesystem marker file.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026
A critical vulnerability tracked as **CVE-2026-69098** affects Cinnamon's **Kotaemon** through version **0.12.0**, allowing unauthenticated remote code execution through the Gradio-exposed `/check_connection` endpoint. The flaw arises because attacker-supplied YAML or JSON is deserialized with insecure settings, letting a request include a `__type__` field that instantiates arbitrary Python classes on the server. Public reporting says the issue can be exploited without credentials, API keys, or user interaction by abusing reachable event-handler endpoints such as `/check_connection` and `/create_llm`. Attackers can reportedly set `__type__` to functions such as `subprocess.check_output` and pass arbitrary arguments to execute operating system commands with the application's privileges, creating risks of file access, database or code modification, and service disruption; the issue is classified as **CWE-502** and has been rated **critical**, with one report assigning a **CVSS 3.1 score of 10.0**.
Aug 5, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026