CVE-2026-128083

### Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions ### Pre-reqs Insecure code and insecure handling of user provided input (devs trust user-provided input) : 1. App has a route that reaches Concurrency::run() (Not by default, it requires app code) 2. The task writes user-controlled data to stdout (echo/print/`dd` of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code) ### Patches * 13.40.0 * 12.71.0