CVE-2026-50149: Envoy Dynamic Script Code Injectioncve-2026-50149-envoy-dynamic-script-code-injection
Dynamically constructing Envoy scripts (like Lua filters) via format strings or buffers allows code injection. An attacker can break out of string literals or inject arbitrary commands if untrusted input is interpolated into the script payload. Instead, pass configuration inputs cleanly through Envoy's FilterContext and read them inside static scripts using
