Weaknesses of type CWE-829

317 results

Inclusão de funcionalidade de esfera de controle não confiável

Ocorre quando o software importa, carrega ou executa código, bibliotecas ou componentes originários de uma fonte não confiável ou não verificada. O atacante consegue injetar funcionalidade maliciosa que rodará com os mesmos privilégios da aplicação, comprometendo a integridade e segurança do sistema.

Example

Uma aplicação web baixa dinamicamente um plugin ou módulo de um servidor externo sem validar assinatura criptográfica ou integridade. Um atacante intercepta ou compromete o servidor de origem e substitui o arquivo legítimo por uma versão maliciosa; a aplicação carrega e executa o código comprometido automaticamente.

How to mitigate

Valide sempre a origem, autenticidade e integridade de componentes antes de carregá-los: use assinatura digital criptográfica, checksums verificados, HTTPS com pinning de certificado e, quando possível, evite carregamento dinâmico. Mantenha inventário atualizado de dependências e aplique patches regularmente.

CVE-2026-26959HIGHADB Explorer Vulnerable to RCE via Insufficient Input ValidationEPSS 0.2%CVE-2026-86063HIGHClaude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningEPSS 0.2%CVE-2026-49449LOWJoplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on WindowsEPSS 0.2%CVE-2026-64805HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toEPSS 0.2%CVE-2026-64808HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingEPSS 0.2%CVE-2026-64809HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreterEPSS 0.2%CVE-2026-64804HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingEPSS 0.2%CVE-2026-64806HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretEPSS 0.2%CVE-2026-55697HIGHpnpm: Repository-controlled configDependencies can select a pacquet native install engineEPSS 0.2%CVE-2026-123276HIGHIn JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profileEPSS 0.2%CVE-2026-123293HIGHIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path settingEPSS 0.2%CVE-2026-123304HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathEPSS 0.2%CVE-2026-123302HIGHIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script eEPSS 0.2%CVE-2025-52655LOWHCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.EPSS 0.2%CVE-2026-123321HIGHIn JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projectsEPSS 0.2%CVE-2026-54532MEDIUMCloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theftEPSS 0.2%CVE-2026-47781HIGHpdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI ParsingEPSS 0.2%CVE-2026-64811HIGHIn JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container confiEPSS 0.2%CVE-2026-64807HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationEPSS 0.2%CVE-2026-65908HIGHIn JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project openEPSS 0.2%