CVE-2025-6775: Wtforms Shell Command Injection
Unsanitized WTForms `.data` input is appended to a list, joined with spaces, and passed to an execution sink. This allows an attacker to inject shell metacharacters and execute arbitrary shell commands. Pass arguments safely via an array or parameterization mechanism rather than joining strings.
Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0
Python
Pythongreprules fetch cve-2025-6775-wtforms-shell-command-injection --engine opengrepDescription
Unsanitized WTForms `.data` input is appended to a list, joined with spaces, and passed to an execution sink. This allows an attacker to inject shell metacharacters and execute arbitrary shell commands. Pass arguments safely via an array or parameterization mechanism rather than joining strings.
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0