Weaknesses of type CWE-150

81 results

Neutralização inadequada de sequências de escape, meta ou controle

Ocorre quando a aplicação não neutraliza adequadamente sequências especiais (escape, meta-caracteres ou controle) antes de processar dados de entrada. Um atacante pode injetar sequências que alteram o comportamento esperado do programa, permitindo execução de comandos não autorizados, manipulação de output ou bypass de validações.

Example

Um sistema que registra mensagens de usuário em logs sem escapar sequências de controle ANSI pode permitir que um atacante injete sequências que limpem o log, ocultam atividades maliciosas ou manipulam a exibição de informações sensíveis para operadores que leem esses logs.

How to mitigate

Valide e escape todas as sequências perigosas (ANSI, shell, XML, HTML, etc.) conforme o contexto de uso dos dados. Use bibliotecas de sanitização apropriadas ao formato (htmlspecialchars() em PHP, shlex.quote() em Python, parametrização em queries SQL) e mantenha listas de caracteres proibidos ou listas brancas de permitidos.

CVE-2024-9774MEDIUMPython-sql: python-sql unary operators does not escape non-expressionEPSS 0.7%CVE-2024-32986CRITICALArbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox EPSS 0.7%CVE-2025-0975HIGHIBM MQ code executionEPSS 0.7%CVE-2023-40185MEDIUMShescape on Windows escaping may be bypassed in threaded contextEPSS 0.7%CVE-2024-50349LOWGit does not sanitize URLs when asking for credentials interactivelyEPSS 0.7%CVE-2026-21521HIGHWord Copilot Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-55193LOWActive Record logging vulnerable to ANSI escape injectionEPSS 0.6%CVE-2026-25996MEDIUMInspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output ModeEPSS 0.6%CVE-2026-62948CRITICALOpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UIEPSS 0.6%CVE-2026-11373CRITICALNet::Statsite::Client versions through 1.1.0 for Perl allow metric injectionsEPSS 0.6%CVE-2026-26149CRITICALMicrosoft Power Apps Desktop Client Spoofing VulnerabilityEPSS 0.6%CVE-2026-73414CRITICALShescape: Shell injection via unescaped parentheses on Windows with CMDEPSS 0.5%CVE-2024-52005HIGHThe sideband payload is passed unfiltered to the terminal in gitEPSS 0.5%CVE-2026-49147HIGHApp::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modesEPSS 0.5%CVE-2025-47284CRITICALGardener vulnerable to metadata injection for a project secret that can lead to privilege escalationEPSS 0.4%CVE-2026-11362CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tagsEPSS 0.4%CVE-2026-82710LOWTerminal escape sequence injection in mix usage_rules.search_docs via package documentation metadataEPSS 0.4%CVE-2026-46720HIGHNet::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-50638CRITICALMetrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2026-21439LOWbadkeys vulnerable to ASCII control character injection on console via malformed inputEPSS 0.3%