# Reference: CVE Catalog

> Notable CVEs organized by category for security review reference. Prioritizes
> instructive, recent (2024-2026), and high-impact entries.

---

## How to Use This Catalog

This catalog is a reference for security reviewers, not a comprehensive database.
Each entry includes a **lesson learned** — the generalizable principle that applies
beyond the specific software affected.

Use it to:
- Quickly check whether your stack uses affected components.
- Extract the design lesson to validate in your own code.
- Prioritize patching and mitigation effort by CVSS score.

For the latest CVE data, always cross-reference with NVD (nvd.nist.gov) and
the relevant advisory database (RUSTSEC, GitHub Security Advisories, etc.).

---

## Category 1: LLM and AI Agent

| CVE | CVSS | Year | Description | Lesson Learned |
|-----|------|------|-------------|---------------|
| CVE-2026-21858 | 10.0 | 2026 | n8n AI Workflow — unauthenticated RCE; full system takeover | AI workflow orchestrators must not expose execution APIs without authentication, even on internal networks |
| CVE-2025-53773 | 9.6 | 2025 | GitHub Copilot / VS Code — RCE via prompt injection in source code, activates "YOLO mode" | Code assistants with tool access are prompt-injection vectors; agentic "approve all" modes must require explicit per-session opt-in |
| CVE-2025-32711 | 9.3 | 2025 | Microsoft 365 Copilot (EchoLeak) — zero-click data exfiltration via Markdown image rendering proxied through Teams | LLMs must never render Markdown images from untrusted content; `![](url)` in LLM output is an exfiltration vector |
| CVE-2025-68664 | 9.3 | 2025 | LangChain Core (LangGrinch) — serialization injection via the `lc` key exfiltrates environment variables including AWS and database credentials | Frameworks with custom serialization keys are code execution vectors; validate and blocklist reserved key names |
| CVE-2025-68143 | Critical | 2025 | MCP Git Server (Anthropic) — arbitrary file access and execution via malicious README | Tools with filesystem or command access that process untrusted repository content need input sandboxing before tool invocation |
| CVE-2025-63389 | Critical | 2025 | Ollama <= 0.12.3 — API completely unauthenticated by default | Self-hosted AI inference servers must ship with authentication enabled by default, not as an optional post-install step |
| CVE-2025-54135 | High | 2025 | Cursor IDE — RCE via malicious `.cursor/mcp.json` injected by a README | IDE extensions with configuration-driven tool access are supply chain attack vectors; validate config files before execution |

---

## Category 2: Web Framework

| CVE | CVSS | Year | Description | Lesson Learned |
|-----|------|------|-------------|---------------|
| CVE-2025-59057 | High | 2026 | React Router — XSS via `meta()` ld+json in Framework Mode; fixed in v7.9.0 | JSON-LD metadata rendered by frameworks must be treated as untrusted content and escaped |
| CVE-2026-22029 | Medium-High | 2026 | React Router — XSS via open redirect in Data Mode; fixed in v7.12.0 | Open redirect parameters that accept external URLs are XSS vectors when the target URL is rendered |
| CVE-2025-26791 | 4.5 | 2025 | DOMPurify — mXSS via incorrect regex on template literals; bypass sanitization | HTML sanitizers that use regex have edge-case bypasses; test with mutation XSS payloads, not just standard vectors |
| CVE-2024-45801 | 7.0 | 2024 | DOMPurify — prototype pollution + depth check bypass | Defense-in-depth: sanitizer bypass is possible; combine with CSP and Content-Type enforcement |
| CVE-2025-13068 | 7.2 | 2025 | WordPress Telegram Bot plugin — stored XSS via unsanitized Telegram username | Usernames from external services (Telegram, OAuth providers) are attacker-controlled and must be sanitized before storage |

---

## Category 3: Desktop Framework

| CVE | CVSS | Year | Description | Lesson Learned |
|-----|------|------|-------------|---------------|
| CVE-2025-31477 | 9.8 | 2025 | tauri-plugin-shell < 2.2.1 — RCE via `file://`, `smb://`, `nfs://` protocol handlers in `shell.open()`; patched in 2.2.1 | Desktop framework IPC commands that open URLs must blocklist dangerous protocol schemes; `file://` is a local RCE vector |
| CVE-2024-35222 | 5.9 | 2024 | Tauri Core — iframes bypass IPC access controls, inheriting parent window capabilities | Embedded iframes in desktop WebViews must not inherit native bridge permissions; isolate iframe origins |
| CVE-2026-0628 | High | 2026 | Chrome/WebView2 — policy bypass affecting Tauri on Windows | Desktop apps embedding Chromium-based WebViews inherit browser engine CVEs; track WebView engine updates separately from app updates |
| CVE-2024-24576 | 10.0 | 2024 | Rust `std::process::Command` on Windows < 1.81.0 — BatBadBut: argument injection when invoking `.bat`/`.cmd` files via `CreateProcessW` | Never pass user input as arguments to batch files; use explicit argument arrays, not shell strings; update Rust toolchain |
| CVE-2024-43402 | — | 2024 | Incomplete fix for CVE-2024-24576 in Rust `std::process::Command` on Windows | Security patches for argument injection are often incomplete; test with the full payload set, not just the original PoC |

---

## Category 4: OS Privilege Escalation

| CVE | CVSS | Year | Description | Lesson Learned |
|-----|------|------|-------------|---------------|
| CVE-2025-43530 | Critical | 2025 | macOS ScreenReader.framework — TCC bypass via misuse of `SecStaticCodeCreateWithPath` vs audit tokens; grants camera/mic/file access | On macOS, verify code identity using audit tokens, not path-based static code checks which are TOCTOU-vulnerable |
| CVE-2025-31250 | Critical | 2025 | macOS Ventura/Sonoma — TCC dialog spoofed via forged XPC message; unpatched at discovery | XPC services that display privilege escalation dialogs must verify sender identity cryptographically, not by process name |
| CVE-2025-6018 | 7.8 | 2025 | Linux PAM + polkit — LPE via `~/.pam_environment` sets `XDG_SEAT` making SSH sessions appear as local console sessions; polkit grants `allow_active` | Polkit policy using `allow_active` is bypassable if PAM exports untrusted environment variables; audit polkit policies |
| CVE-2025-6019 | 7.8 | 2025 | udisks2 / libblockdev — LPE via omitted `nosuid` mount flag; user-mounted filesystem can contain SUID binaries | Mount operations from user-controlled inputs must always include `nosuid,noexec,nodev` |
| CVE-2021-4034 | 7.8 | 2021 | pkexec (PwnKit) — out-of-bounds write enables LD_PRELOAD injection → root on most Linux distributions | Long-lived SUID binaries accumulate vulnerabilities; audit polkit helpers; pkexec should not be available to applications that do not need it |
| CVE-2023-29343 | High | 2023 | Sysmon (Windows) — EoP to SYSTEM via improper symlink resolution in the monitoring driver itself | Security tools running as SYSTEM with complex kernel-level logic are high-value targets; keep them patched |

---

## Category 5: Supply Chain

| CVE | CVSS | Year | Description | Lesson Learned |
|-----|------|------|-------------|---------------|
| CVE-2025-30066 | Critical | 2025 | tj-actions/changed-files GitHub Actions — compromised action leaks all CI secrets into public build logs | All third-party Actions must be pinned to an exact commit SHA, never a mutable tag; a compromised tag silently updates all workflows using it |
| CVE-2025-59288 | 5.3 | 2025 | Playwright Python < 1.55.1 — macOS install script uses `curl -k` (disables TLS verification) enabling MitM during browser binary download | Install scripts must never disable TLS verification; downloaded binaries must be hash-verified before execution |
| GHSA-4xh5-x5gv-qwph | — | 2025 | pip < 25.2 — path traversal in malicious sdist packages | Package managers must validate archive contents; run dependency installs in isolated environments without write access to the application directory |
| RUSTSEC-2025-0151 | — | 2025 | `sha-rst` Rust crate — malicious package impersonating `sha2`; exfiltrates credentials | Package names differing by one character (typosquatting) are common; use `cargo deny` to allowlist permitted packages by exact name |

**Notable supply chain incidents (no formal CVE):**
- **September 2025 — chalk/debug npm:** 2.6 billion weekly downloads compromised across 18 packages via phishing of maintainer with real-time OTP capture. CISA alert September 23, 2025.
- **August 2025 — Shai-Hulud npm worm:** Self-propagating worm affected 500+ packages v1, 25,000+ repositories v2; executed at `preinstall`.
- **February 2025 — nullifAI HuggingFace:** Pickle file with corrupted 7z wrapper bypassed Picklescan; installed reverse shell via model download.

---

## Category 6: Cryptographic

| CVE / Advisory | CVSS | Year | Description | Lesson Learned |
|----------------|------|------|-------------|---------------|
| CVE-2025-6965 | 7.2 | 2025 | SQLite <= 3.50.1 — memory corruption via aggregation queries; discovered by Google's "Big Sleep" AI-assisted fuzzing | SQLite versions are frequently embedded and not updated with the OS; pin and track embedded SQLite version separately |
| CVE-2022-29185 / RUSTSEC-2022-0018 | — | 2022 | `totp-rs` < 1.1.0 — non-constant-time TOTP comparison; timing attack reduces search space from 10^6 to ~60 requests | OTP and token comparison must use constant-time functions; standard `==` leaks timing information |
| RUSTSEC-2025-0004 | — | 2025 | `openssl` crate (native-tls) — use-after-free in TLS; affects `reqwest` < 0.13 with native-tls feature | Prefer `rustls` (pure Rust TLS) over bindings to OpenSSL; C library wrappers inherit memory safety issues |
| CVE-2025-15467 | — | 2025 | OpenSSL 3.5.4 — crypto provider issue affecting SQLCipher | SQLCipher's security depends on the underlying OpenSSL version; track OpenSSL CVEs even for embedded uses |

---

## Category 7: Authentication Bypass

| CVE | CVSS | Year | Description | Lesson Learned |
|-----|------|------|-------------|---------------|
| CVE-2025-52572 | 10.0 | 2025 | Hikka Telegram userbot — web interface with no authentication; RCE and full Telegram account access; exploited in the wild | Any web interface that controls an authenticated session must itself require authentication; localhost is not a security boundary |
| CVE-2025-31191 | High | 2025 | macOS — sandbox escape via security-scoped bookmark abuse | Security-scoped bookmarks that persist filesystem access across sandboxed app restarts must be validated on each use |
| CVE-2024-20671 | High | 2024 | Windows Defender — protection bypass | Defense tools themselves can be bypassed; layered detection (not single-tool reliance) is essential |

---

## Notable Patterns Without Formal CVE

These are architectural vulnerabilities that consistently cause breaches but lack CVE
assignment (Microsoft officially does not treat UAC bypass as a security boundary violation):

| Pattern | Impact | Detection |
|---------|--------|-----------|
| Telegram bot token in process environment | Token readable via `/proc/PID/environ` by same-user processes; full bot control | Store tokens only in OS keychain, never in environment variables |
| `==` comparison for secrets/tokens | Timing oracle reduces brute force complexity by orders of magnitude | Code audit: grep for `==` applied to secrets, hashes, tokens |
| Webhook without `secret_token` | Any IP can inject arbitrary fake updates into the bot's processing queue | Always configure a `secret_token` on webhook registration |
| UAC bypass (Windows) | 80+ active methods on Windows 11 24H2; Microsoft classifies as non-security-boundary | Do not rely on UAC as a security boundary; applications requiring privilege must use a separately-reviewed privileged helper |
| Docker bypassing UFW iptables | Docker adds iptables rules that bypass UFW entirely; ports mapped by containers are internet-accessible regardless of UFW rules | Always check `iptables -L -n` in addition to UFW status; use Docker's `--network` options carefully |
| PyInstaller `--key` (historical) | Never effective: the AES key was stored in `pyimod00_crypto_key` inside the same binary | Obfuscation tools that store the key with the ciphertext provide zero security; do not confuse obfuscation with encryption |