VDB
GCVE-110-OSM-2026-10644
GCVE-110-OSM-2026-10644
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: code execution.
Payload: setup.py
Secondary files: mangrove_sdk/runner.py
Key findings:
- Shell Command Execution in mangrove_sdk/runner.py: "subprocess.call("
- setup.py Code Execution in setup.py: "cmdclass={
"install""
- Setup.py Command Override in setup.py: "cmdclass={
"install""
IOCs:
- urls: https://mangrove-agent-proxy.fly.dev, https://example.test, https://x
- domains: mangrove-agent-proxy.fly.dev, example.test, x
- payloadFileHash: 60ee99e6696abc3165f973aa4e2f6732369a5d70eb46e6e935a23d81b5356d8e
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | mangrove-sdk | all (affected) | — |
Aliases
Browse GCVE Records
831 records in the GCVE database · Updated September 3, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.