Weaknesses of type CWE-150

93 results

Neutralização inadequada de sequências de escape, meta ou controle

Ocorre quando a aplicação não neutraliza adequadamente sequências especiais (escape, meta-caracteres ou controle) antes de processar dados de entrada. Um atacante pode injetar sequências que alteram o comportamento esperado do programa, permitindo execução de comandos não autorizados, manipulação de output ou bypass de validações.

Example

Um sistema que registra mensagens de usuário em logs sem escapar sequências de controle ANSI pode permitir que um atacante injete sequências que limpem o log, ocultam atividades maliciosas ou manipulam a exibição de informações sensíveis para operadores que leem esses logs.

How to mitigate

Valide e escape todas as sequências perigosas (ANSI, shell, XML, HTML, etc.) conforme o contexto de uso dos dados. Use bibliotecas de sanitização apropriadas ao formato (htmlspecialchars() em PHP, shlex.quote() em Python, parametrização em queries SQL) e mantenha listas de caracteres proibidos ou listas brancas de permitidos.

CVE-2026-81856LOWTerminal escape sequence injection in Hex via unneutralized server-supplied outputEPSS 0.4%CVE-2026-73035MEDIUMnpm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape SequencesEPSS 0.4%CVE-2026-46720HIGHNet::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-50638CRITICALMetrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2025-58160LOWTracing logging user input may result in poisoning logs with ANSI escape sequencesEPSS 0.3%CVE-2026-102601LOWFlysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterEPSS 0.3%CVE-2026-21439LOWbadkeys vulnerable to ASCII control character injection on console via malformed inputEPSS 0.3%CVE-2026-9270CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injectionsEPSS 0.3%CVE-2026-46740MEDIUMMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-50637HIGHMetrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2024-56201MEDIUMJinja has a sandbox breakout through malicious filenamesEPSS 0.3%CVE-2026-46719MEDIUMNet::Statsd::Lite versions before 0.9.0 for Perl allowed metric injectionsEPSS 0.3%CVE-2025-23026MEDIUMHTML templates containing Javascript template strings are subject to XSS in jteEPSS 0.3%CVE-2025-30089MEDIUMgurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.EPSS 0.3%CVE-2026-3108HIGHTerminal Escape Injection in mmctl Report Posts CommandEPSS 0.3%CVE-2025-1692MEDIUMMongoDB Shell may be susceptible to control character injection via pastingEPSS 0.3%CVE-2026-39879HIGHSQL injection in syslog-ng SQL destionation driverEPSS 0.3%CVE-2023-39342LOWDangerzone CLI does not sanitize ANSI escape characters EPSS 0.3%CVE-2026-50639MEDIUMMetrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2026-46741HIGHEtsy::StatsD versions through 1.002002 for Perl allow metric injectionsEPSS 0.3%