Improper control of code generation in Staggs staggs allows remote code inclusion, affecting versions through 3.3.0.
An unauthenticated attacker over the network can execute arbitrary code remotely by exploiting the code injection vulnerability in the code generation mechanism.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes, a patch is available.
Update Staggs to a version beyond 3.3.0. Monitor the GitHub Advisory ( for patched version information and apply updates immediately given the critical nature of this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-78287 . See article
NVD published the first details for CVE-2026-78287
A CVSS base score of 10 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-frhh-fmq4-p6rw] Improper Control of Generation of Code ('Code Injection') vulnerability in Stagg
CVE-2026-78287 - Exploits & Severity - Feedly
CVE-2026-110697: Quay Cross-Tenant Credential Theft via Unescaped SQL Wildcards (CVE-2026-110697)
CVE-2026-123710: Red Hat Quay Unauthenticated Key Rotation Flaw Leads to Full Registry Compromise
CVE-2026-64678: Nitrite DB Legacy Migration Deserialization Enables RCE
Code Injection Vulnerability in Staggs Plugin by WordPress
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
