Weaknesses of type CWE-470

93 results

Reflexão insegura com entrada externa

Ocorre quando a aplicação usa dados controlados pelo usuário para carregar, instanciar ou invocar classes e métodos via reflexão, sem validação prévia. Um atacante pode então executar código arbitrário ou acessar funcionalidades não intencionadas, porque o desenvolvedor delegou ao usuário a decisão de qual código será rodado.

Example

Um sistema Java recebe um parâmetro 'className' via URL e faz Class.forName(className).newInstance(). Se o usuário enviar o nome de uma classe perigosa do sistema ou uma classe maliciosa em classpath, ela será instanciada e executará lógica não autorizada.

How to mitigate

Mantenha uma whitelist rigorosa de classes permitidas, valide e normalize toda entrada antes de usar em reflexão, e considere usar enums ou constantes em vez de nomes de classe oriundos de entrada externa. Limite as permissões do aplicativo conforme o princípio do menor privilégio.

CVE-2026-24246HIGHNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourcEPSS 0.4%CVE-2025-61925MEDIUMAstro's `X-Forwarded-Host` is reflected with no validationEPSS 0.4%CVE-2026-61599HIGHdjust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathEPSS 0.4%CVE-2026-66269HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('EPSS 0.4%CVE-2026-44339HIGHPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeEPSS 0.4%CVE-2026-79987HIGHLow-privilege RCE through element-search eager loadingEPSS 0.4%CVE-2026-17593HIGHNexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationEPSS 0.4%CVE-2026-10853HIGHIBM MQ queue manager is vulnerable to remote code executionEPSS 0.4%CVE-2026-48517MEDIUMMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsEPSS 0.3%CVE-2026-57284MEDIUMJenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniEPSS 0.3%CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.3%CVE-2026-58659HIGHPyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterEPSS 0.3%CVE-2026-79784HIGHVocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model ConfigurationEPSS 0.3%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.3%CVE-2026-54614MEDIUMDebugKit: MailPreview contains unsafe reflectionEPSS 0.3%CVE-2026-53666MEDIUMReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationEPSS 0.3%CVE-2026-41175HIGHStatamic: Unsafe method invocation via query value resolution allows data destructionEPSS 0.3%CVE-2026-61536HIGHBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEEPSS 0.3%CVE-2026-64663MEDIUMStatamic: Unsafe method invocation via Antlers template resolution allows data destructionEPSS 0.3%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.3%