CVE-2025-12389

In OpenHuman before version 0.57.13, an attacker able to send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers.

In OpenHuman before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic AgentTurnRequest using the default tool policy without an interactive approval context. ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows node_exec to run despite the default Supervised policy requiring approval.

Cocos AI in version 0.8.2 and earlier accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. The vulnerability is addressed in 0.9.0, but cannot be patched in source code alone since it arises from the confidential computing threat model itself.

A Code Injection vulnerability in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding mainDecoratorLocation, causing evaluation of an unsandboxed Groovy expression.

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker who captures a live externalLoginKey to obtain a complete session as the issuing user across all webapps, because the key is accepted as a bearer credential never bound to a client, never expires, and is not invalidated after use.

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

Cross-site Scripting (XSS) vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in page chrome fields (header, nav, footer, etc.), so applications that place request-derived values there reflect them unencoded.

HTTP Response Splitting (CRLF injection in HTTP headers) vulnerability in Apache Juneau. The REST server passed response header values and redirect targets to the servlet container unchecked, so request-derived data could allow header injection or redirect to an arbitrary site.

Insufficiently Protected Credentials vulnerability in Apache Juneau. The RestClient followed HTTP redirects while keeping credential headers from the original request, so a server redirecting to a different host, port, or from HTTPS to HTTP could receive Authorization, Cookie, Proxy-Authorization and X-API-Key headers.

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response and may include internal exception messages in the error body, even with stack-trace rendering disabled.