CVE-2026-5532

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

A vulnerability was found in ScrapeGraphAI scrapegraph-ai up to 1.74.0. The affected element is the function create_sandbox_and_execute of the file scrapegraphai/nodes/generate_code_node.py of the component GenerateCodeNode Component. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
ScrapeGraphAIscrapegraph-ai1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19

References

Timeline

Published
Apr 5, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-553217.8In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to local eCVE-2026-553237.8In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local CVE-2026-55334.3A vulnerability was determined in badlogic pi-mono 0.58.4. The impacted element is an unknown function of the file packages/web-ui/src/toolsCVE-2026-553309.8In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could leadCVE-2026-553318.8In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code executiCVE-2026-553326.7In multiple locations, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privCVE-2026-553359.8In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with noCVE-2026-55347.3A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.phCVE-2026-553438.0In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote coCVE-2026-553447.8In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This could lead to local eCVE-2026-553466.7In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds checkCVE-2026-553482.3In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a nega
CVE-2026-5532: Medium severity, CVSS 6.3 | Vulnix