Weaknesses of type CWE-829

317 results

Inclusão de funcionalidade de esfera de controle não confiável

Ocorre quando o software importa, carrega ou executa código, bibliotecas ou componentes originários de uma fonte não confiável ou não verificada. O atacante consegue injetar funcionalidade maliciosa que rodará com os mesmos privilégios da aplicação, comprometendo a integridade e segurança do sistema.

Example

Uma aplicação web baixa dinamicamente um plugin ou módulo de um servidor externo sem validar assinatura criptográfica ou integridade. Um atacante intercepta ou compromete o servidor de origem e substitui o arquivo legítimo por uma versão maliciosa; a aplicação carrega e executa o código comprometido automaticamente.

How to mitigate

Valide sempre a origem, autenticidade e integridade de componentes antes de carregá-los: use assinatura digital criptográfica, checksums verificados, HTTPS com pinning de certificado e, quando possível, evite carregamento dinâmico. Mantenha inventário atualizado de dependências e aplique patches regularmente.

CVE-2026-114727HIGHRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS EPSS 0.3%CVE-2026-59831MEDIUMGitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious CodespaceEPSS 0.3%CVE-2022-4134LOWA flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrEPSS 0.3%CVE-2025-41390HIGHAn arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repEPSS 0.3%CVE-2026-118762CRITICALMonkeytype: fork PR can execute code with elevated GITHUB_TOKENEPSS 0.3%CVE-2022-33317HIGHInclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, MitsubishEPSS 0.3%CVE-2026-118178MEDIUMRSS feed could redirect its subscription to a local file or network shareEPSS 0.3%CVE-2026-22551MEDIUMIn Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitraryEPSS 0.3%CVE-2026-122160MEDIUMmyshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphereEPSS 0.3%CVE-2026-40154CRITICALPraisonAI Affected by Untrusted Remote Template Code ExecutionEPSS 0.3%CVE-2026-33075CRITICALFastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.ymlEPSS 0.3%CVE-2026-40313CRITICALPraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential PersistenceEPSS 0.3%CVE-2026-50195MEDIUMcontainerd: CRI checkpoint import allows local image tag poisoningEPSS 0.3%CVE-2026-55698HIGHpnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesEPSS 0.3%CVE-2026-87695HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-12509HIGHScripts for the module Global_Shipping executable on BRAIN2 ServerEPSS 0.3%CVE-2026-115802MEDIUMInternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphereEPSS 0.3%CVE-2025-55305MEDIUMElectron is vulnerable to Code Injection via resource modificationEPSS 0.3%CVE-2026-85355HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-24821HIGHCode execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in ComposerEPSS 0.3%