Weaknesses of type CWE-150

81 results

Neutralização inadequada de sequências de escape, meta ou controle

Ocorre quando a aplicação não neutraliza adequadamente sequências especiais (escape, meta-caracteres ou controle) antes de processar dados de entrada. Um atacante pode injetar sequências que alteram o comportamento esperado do programa, permitindo execução de comandos não autorizados, manipulação de output ou bypass de validações.

Example

Um sistema que registra mensagens de usuário em logs sem escapar sequências de controle ANSI pode permitir que um atacante injete sequências que limpem o log, ocultam atividades maliciosas ou manipulam a exibição de informações sensíveis para operadores que leem esses logs.

How to mitigate

Valide e escape todas as sequências perigosas (ANSI, shell, XML, HTML, etc.) conforme o contexto de uso dos dados. Use bibliotecas de sanitização apropriadas ao formato (htmlspecialchars() em PHP, shlex.quote() em Python, parametrização em queries SQL) e mantenha listas de caracteres proibidos ou listas brancas de permitidos.

CVE-2026-9270CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injectionsEPSS 0.3%CVE-2026-46740MEDIUMMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injectionsEPSS 0.3%CVE-2025-58160LOWTracing logging user input may result in poisoning logs with ANSI escape sequencesEPSS 0.3%CVE-2026-50637HIGHMetrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2024-56201MEDIUMJinja has a sandbox breakout through malicious filenamesEPSS 0.3%CVE-2026-46719MEDIUMNet::Statsd::Lite versions before 0.9.0 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-19591HIGHOpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe becEPSS 0.3%CVE-2026-82584LOWTerminal escape sequence injection in the mix igniter.install confirmation prompt via package metadataEPSS 0.3%CVE-2025-23026MEDIUMHTML templates containing Javascript template strings are subject to XSS in jteEPSS 0.3%CVE-2025-30089MEDIUMgurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.EPSS 0.3%CVE-2026-3108HIGHTerminal Escape Injection in mmctl Report Posts CommandEPSS 0.3%CVE-2025-1692MEDIUMMongoDB Shell may be susceptible to control character injection via pastingEPSS 0.3%CVE-2026-39879HIGHSQL injection in syslog-ng SQL destionation driverEPSS 0.3%CVE-2026-72913HIGHKitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequencesEPSS 0.3%CVE-2023-39342LOWDangerzone CLI does not sanitize ANSI escape characters EPSS 0.3%CVE-2026-50639MEDIUMMetrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2026-46741HIGHEtsy::StatsD versions through 1.002002 for Perl allow metric injectionsEPSS 0.3%CVE-2026-35651MEDIUMOpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval PromptEPSS 0.3%CVE-2026-46739MEDIUMNet::Statsd versions before 0.13 for Perl allow metric injectionsEPSS 0.3%CVE-2026-8788HIGHNet::Statsd::Lite versions through 0.10.0 for Perl allowed metric injectionsEPSS 0.2%