command-injection

An isolated Docker-based cybersecurity lab for learning the Vulnerability → Exploit → Payload workflow.

Halt Academy’s Docker-based vulnerable web application lab for practicing OS Command Injection in a controlled environment. Learn vulnerability discovery, payload testing, command execution, impact analysis, and mitigation techniques. Designed for cybersecurity students, penetration testers, bug bounty hunters, and security professionals.

Hardened yt-dlp wrapper for Node.js: SSRF host allowlist, command and argument injection protection, timeouts and concurrency limits. Zero dependencies.

CVE-2026-52616 — mcp-nmap-server: OS command injection via run_nmap_scan (duplicate of CVE-2026-3484)

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command injection via executeDeployment extra vars (fixed in 2.0.3)

Agent runtime guard — full-stack runtime interception for AI agents. Blocks destructive commands, credential theft, SSRF and injection in real time, with Ed25519 evidence receipts. Agent 运行时全栈拦截.

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options (no fixed version)

CVE-2025-23061 - Mongoose Command Injection

Sistema de notas propositalmente vulnerável para educação em segurança cibernética e testes de penetração - contém 12+ vulnerabilidades web intencionais (SQL Injection, XSS, Path Traversal, Command Injection, etc.)

OS command injection (CWE-78) in Yoshino-Yukitaro/imagemagick_mcp_server — advisory, detection and PoC. Repository archived upstream; no fix possible.

Transparent stdio proxy for MCP servers — fail-closed agent runtime interception: denies, verifier errors and timeouts are never forwarded. Ed25519 receipts. Agent 运行时全栈拦截.