CVE-2026-108598

Critical Code Injection Vulnerability in Floci Affects Unauthenticated Users

CVE-2026-108598 — Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates Most recent entries from cvelistv5 / 20h Affected: floci-io floci Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Fl

Code Injection Duo — 2 CVEs, Peak CVSS 9.8 in openapi-typescript-codegen and Floci Velocity ThreatAft — Cybersecurity Intelligence / 11h Impact: CVE-108551 allows JavaScript injection into generated TypeScript clients via unescaped Handlebars interpolation — supply-chain compromise of build pipelines. If your CI/CD pipeline ingests OpenAPI specs from vendors, partners, or public repos, an attacker controlling that spec achieves code execution inside your build environment.

CVE-2026-108598 - Exploits & Severity