#expression-injection

0 stories this week · 1 this month · 4 in 6 months · mostly security

Stories per day · 30 days

3 stories, newest first · one card per story

A low-privileged attacker can inject expressions through the CamelAwsS3Key header; the CVSS score is 5.4.

arXiv cs.CRSep 27, 2026high

Paper shows n8n expression sandboxes can be bypassed, citing three CVEs including two CVSS 9.4 flaws.

Flextype CMS v1.0.0-alpha.3 stored expression injection exposes the mutable registry object, enabling stored PHP remote code execution.

Stories tagged #expression-injection