#vulns.co
/
mcp by GKData.io

← Back to Reports

Parser and execution boundaries

High-impact cases where structured input, archives, queries, or serialized objects crossed into an interpreter or unsafe write primitive.

Pattern collection. This is original synthesis across public, source-verified disclosures; severity labels remain exactly as reported by each source.

Field lens

The key question is where data stops being data. Strong evidence identifies the interpreter, parser, extraction root, query engine, or process-launch boundary and confirms the smallest benign effect.

Evidence that changes the decision

  • A controlled value changes command, query, object, or filesystem behavior.
  • A non-executing control distinguishes parser behavior from a coincidental error.
  • The disclosure bounds the execution or write context instead of assuming full compromise.

Control themes

  • Use data-only parsers and parameterized APIs instead of evaluators or string-built commands.
  • Canonicalize archive output paths and keep extraction inside a dedicated root.
  • Apply least privilege so a parser or worker cannot turn one mistake into platform-wide access.

Reviewed disclosures in this collection

Command injection in a scientific analysis tool

P1 National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program · OS command injection

The public disclosure describes controlled confirmation of input reaching a command-execution boundary without accessing NASA systems.

Archive extraction path-traversal exposure

P2 National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program · Improper path restriction during archive extraction

The public disclosure reports a benign file-write confirmation outside the intended extraction location.

Blind SQL-injection signal in a public search surface

P1 National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program · Blind SQL injection

The disclosed report describes a timing-based inference signal rather than direct response-body extraction.

Unsafe deserialization in a scientific-analysis project

P1 National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program · Insecure deserialization

The public source attributes the condition to deserializing untrusted data and states that the risky format was replaced.

Unsafe input evaluation in an API validation path

P1 National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program · Unsafe evaluation of untrusted input

The source says the public issue was remediated by changing from an evaluating reader to a data-only parser.

Log4j remote code injection

critical; CVSS 10.0 Apache · Injection through untrusted log data reaching a lookup-capable component

The public advisory establishes that attacker-controlled data could cross from logging input into a component with code-execution consequences.

Spring Framework remote code execution

critical; CVSS 9.8 VMware / Spring · Improper neutralization of special elements in data binding

The advisory identifies a data-binding path where specially formed request properties could alter server-side behavior in affected deployments.

MOVEit Transfer SQL injection

critical; CVSS 9.8 Progress Software · SQL injection

The public advisory describes an injection flaw in an internet-facing file-transfer product, requiring affected instances to be identified and remediated.

Apache ActiveMQ remote code execution

critical; CVSS 10.0 Apache · Deserialization of untrusted data

The source identifies unsafe handling of serialized data in affected broker deployments.

PAN-OS GlobalProtect command injection

critical; CVSS 9.8 Palo Alto Networks · Command injection

The advisory identifies untrusted input reaching command-processing behavior in an exposed remote-access product feature.

TeamCity authentication bypass

critical; CVSS 9.8 JetBrains · Authentication bypass using an alternate path or channel

The advisory identifies an authentication bypass that could enable administrative actions on affected CI servers.

PHP CGI argument injection

critical; CVSS 9.8 PHP · OS command injection

The source describes a deployment-specific argument-handling issue involving PHP CGI and Apache configurations.

← Back to Reports