Weaknesses of type CWE-506

103 results

Código malicioso embutido

É quando código malicioso ou prejudicial é intencionalmente inserido em um software legítimo, seja por um desenvolvedor comprometido, uma dependência infectada ou um processo de build comprometido. O risco é que a aplicação executa ações maliciosas (roubo de dados, backdoor, espionagem) sem que o usuário ou mesmo a organização responsável saiba.

Example

Um desenvolvedor adiciona silenciosamente um trecho que envia credenciais de usuários para um servidor externo, ou uma biblioteca open-source popular é comprometida e passa a incluir código que minera criptomoredas nos servidores das empresas que a usam.

How to mitigate

Implementar revisão de código rigorosa e segregação de acesso (principle of least privilege), auditar dependências e versões de bibliotecas, usar integridade de artefatos (assinatura de pacotes, SBOM), e monitorar comportamento anômalo em execução (logs, atividade de rede). Também: manter cadeia de custódia clara do código-fonte e pipeline de build seguro.

CVE-2026-77651CRITICALThe arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a roEPSS 0.8%CVE-2026-66747CRITICALENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root ImplantEPSS 0.8%CVE-2026-46412CRITICALMalicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud wormEPSS 0.8%CVE-2026-67595CRITICALVaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.phpEPSS 0.8%CVE-2017-16207—discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.EPSS 0.7%CVE-2026-48160CRITICALreact-tracked was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-48161CRITICALreact18-use was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-48159CRITICALuse-reducer-async was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-48158CRITICALuse-context-selector was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-73532CRITICALFluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin BuildEPSS 0.7%CVE-2017-20203CRITICALNetSarang v5.0 Malicious Backdoor Supply Chain CompromiseEPSS 0.7%CVE-2026-111862CRITICALRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeEPSS 0.7%CVE-2026-73533CRITICALNinja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin BuildEPSS 0.6%CVE-2026-31976CRITICALxygeni-action v5 tag poisoned with C2 backdoorEPSS 0.6%CVE-2025-10894CRITICALNx: nx/devkit: malicious versions of nx and plugins published to npmEPSS 0.6%CVE-2026-34424CRITICALSmart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitEPSS 0.6%CVE-2025-59145HIGHcolor-name@2.0.1 contains malware after npm account takeoverEPSS 0.6%CVE-2017-20202CRITICALWeb Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain CompromiseEPSS 0.5%CVE-2017-20201CRITICALCCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain CompromiseEPSS 0.5%CVE-2026-46421CRITICALSupply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)EPSS 0.5%