Signals
Back to database
Soon60Medium6.0VulnerabilityCVE-2026-105404No patch link observed

CVE-2026-105404 — ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not …

Published Oct 8, 2026, 03:17 PM UTCIngested 7h agoSource NVD(cve-db)CVE-2026-105404

Description

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by these coders.

CVSS v4.0 base metrics

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
6.0

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Network

Attack Vector

AC

High

Attack Complexity

AT

Present

Attack Requirements

PR

None

Privileges Required

UI

Passive

User Interaction

VC

High

Confidentiality (Vulnerable System)

VI

None

Integrity (Vulnerable System)

VA

None

Availability (Vulnerable System)

SC

None

Confidentiality (Subsequent System)

SI

None

Integrity (Subsequent System)

SA

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor
Medium

CVE-2026-11888 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.

CVE-2026-11888 · 3h ago

High

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

CVE-2026-61433 · 4h ago

Critical

CVE-2026-107700 — dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted path…

CVE-2026-107700 · 5h ago

High

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

CVE-2026-61446 · 7h ago

Critical

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

CVE-2026-61447 · 7h ago

High

CVE-2026-76484 — As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Sma…

CVE-2026-76484 · 1d ago