If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions
Insecure code and insecure handling of user provided input (devs trust user-provided input) :
App has a route that reaches Concurrency::run() (Not by default, it requires app code)
The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)
{
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2026-11-13T18:54:31Z",
"nvd_published_at": null,
"severity": "LOW"
}