CVE-2025-15060

claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeClaudeCode method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27785.

• CWE-78

• https://www.zerodayinitiative.com/advisories/ZDI-26-124/

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15055The SlimStat Analytics plugin for WordPress is vulnerable to…7.2
• CVE-2025-15056A lack of data validation vulnerability in the HTML export f…6.1
• CVE-2025-15057The SlimStat Analytics plugin for WordPress is vulnerable to…7.2
• CVE-2025-15058The Responsive Pricing Table plugin for WordPress is vulnera…6.4
• CVE-2025-15059GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code…7.8
• CVE-2025-1506The Wp Social Login and Register Social Counter plugin for W…4.3
• CVE-2025-15061Framelink Figma MCP Server fetchWithRetry Command Injection …9.8
• CVE-2025-15062Trimble SketchUp SKP File Parsing Use-After-Free Remote Code…7.8
• CVE-2025-15063Ollama MCP Server execAsync Command Injection Remote Code Ex…9.8
• CVE-2025-15064The Ultimate Member – User Profile, Registration, Login, Mem…6.4
• CVE-2025-15065Exposure of Sensitive Information to an Unauthorized Actor, …8.6
• CVE-2025-15066Improper Limitation of a Pathname to a Restricted Directory …6.9