GCVE-110-PYPI-2026-020516

Advisory Published

Vulnetix · Advisory published October 13, 2026

[P-PYTHON-EXEC-COMPOUND] Python one-liner with exec() (obfuscated code execution) — matched: for command in ['python -c \'exec(open("migrate.py").read())\'', 'python -m migrate', '. migrate.py', 'source migrate.py', 'find "$HOME" -name SKILL.md -exec cat {} +', 'cat ../SKILL.md', 'cat /tmp/SKILL.md', 'python -c "import urllib.request"', 'node -e "fetch(url)"', 'git fetch', 'gh api user', 'c

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious CodeCWE-94Improper Control of Generation of Code ('Code Injection')

Affected Products

Vendor	Product	Versions	Platforms
pypi	abvx-agent-skills	0.16.0 (affected), 0.16.1 (affected)	—

References

advisory

web

Browse GCVE Records

3,691 records in the GCVE database · Updated October 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON