Weaknesses of type CWE-913

69 results

Controle inadequado de recursos de código gerenciados dinamicamente

Fraqueza onde a aplicação carrega, executa ou modifica código em tempo de execução sem validação ou isolamento apropriado. O atacante consegue injetar ou manipular código dinâmico (scripts, bytecode, plugins) porque não há barreira de segurança entre a fonte do código e sua execução, resultando em execução de código arbitrário.

Example

Um aplicativo que carrega plugins .jar de um diretório sem verificar assinatura digital ou sandbox, permitindo que um arquivo malicioso substituído execute com os mesmos privilégios da JVM. Ou um servidor que avalia JavaScript enviado pelo cliente via eval() sem sanitização.

How to mitigate

Validar criptograficamente (hash, assinatura digital) todo código dinâmico antes de carregar; usar sandbox ou runtime restrito (AppDomains, módulos isolados) se possível; nunca usar eval() ou equivalentes com entrada não confiável; carregar código apenas de fontes pré-aprovadas com controle de acesso rigoroso.

CVE-2025-68613CRITICALn8n Vulnerable to Remote Code Execution via Expression InjectionEPSS 97.9%KEVCVE-2023-50386HIGHApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsEPSS 83.8%CVE-2023-29017CRITICALvm2 Sandbox Escape vulnerabilityEPSS 63.2%CVE-2022-36067CRITICALvm2 vulnerable to Sandbox Escape before v3.9.11EPSS 47.9%CVE-2023-6184MEDIUMCross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site ScriptingEPSS 46.6%CVE-2026-34156CRITICALNocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script NodeEPSS 36.5%CVE-2024-7297HIGHLangflow Privilege EscalationEPSS 21.3%CVE-2025-66398CRITICALSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)EPSS 18.2%CVE-2017-3202—The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code controlEPSS 8.3%CVE-2017-3200—The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code controlEPSS 6.2%CVE-2024-27135HIGHApache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionEPSS 6.0%CVE-2023-29199CRITICALvm2 Sandbox escape vulnerabilityEPSS 3.9%CVE-2025-13659HIGHImproper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticEPSS 1.9%CVE-2026-47210CRITICALvm2 sandbox escape via JSPI-backed Promise `.finally()` species bypassEPSS 1.8%CVE-2020-3419MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Ghost Join VulnerabilityEPSS 1.7%CVE-2022-40635MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.3%CVE-2022-40634MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.3%CVE-2019-1617HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityEPSS 1.3%CVE-2026-22709CRITICALvm2 has a Sandbox EscapeEPSS 1.2%CVE-2026-25049CRITICALn8n Has an Expression Escape Vulnerability Leading to RCEEPSS 1.2%