CVE-2023-26107

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

• CWE-94
• CWE-94
• CWE-94

• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115Broken Link
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64Broken Link
• https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969Exploit, Third Party Advisory
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115Broken Link
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64Broken Link
• https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969Exploit, Third Party Advisory

Published

Mar 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26101In Progress Flowmon Packet Investigator before 12.1.0, a Flo…7.5
• CVE-2023-26102All versions of the package rangy are vulnerable to Prototyp…8.2
• CVE-2023-26103Versions of the package deno before 1.31.0 are vulnerable to…7.5
• CVE-2023-26104All versions of the package lite-web-server are vulnerable t…7.5
• CVE-2023-26105All versions of the package utilities are vulnerable to Prot…7.5
• CVE-2023-26106All versions of the package dot-lens are vulnerable to Proto…7.5
• CVE-2023-26108Versions of the package @nestjs/core before 9.0.5 are vulner…5.3
• CVE-2023-26109All versions of the package node-bluetooth-serial-port are v…9.8
• CVE-2023-2611Advantech R-SeeNet versions 2.4.22 is installed with a hi…9.8
• CVE-2023-26110All versions of the package node-bluetooth are vulnerable to…9.8
• CVE-2023-26111All versions of the package @nubosoftware/node-static; all v…7.5
• CVE-2023-26112All versions of the package configobj are vulnerable to Regu…5.9