Weaknesses of type CWE-913

95 results

Controle inadequado de recursos de código gerenciados dinamicamente

Fraqueza onde a aplicação carrega, executa ou modifica código em tempo de execução sem validação ou isolamento apropriado. O atacante consegue injetar ou manipular código dinâmico (scripts, bytecode, plugins) porque não há barreira de segurança entre a fonte do código e sua execução, resultando em execução de código arbitrário.

Example

Um aplicativo que carrega plugins .jar de um diretório sem verificar assinatura digital ou sandbox, permitindo que um arquivo malicioso substituído execute com os mesmos privilégios da JVM. Ou um servidor que avalia JavaScript enviado pelo cliente via eval() sem sanitização.

How to mitigate

Validar criptograficamente (hash, assinatura digital) todo código dinâmico antes de carregar; usar sandbox ou runtime restrito (AppDomains, módulos isolados) se possível; nunca usar eval() ou equivalentes com entrada não confiável; carregar código apenas de fontes pré-aprovadas com controle de acesso rigoroso.

CVE-2019-1617HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityEPSS 1.3%CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2020-25803MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.EPSS 1.1%CVE-2020-25802MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.EPSS 1.1%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%CVE-2026-47208CRITICALvm2: Sandbox Breakout Using Promise SpeciesEPSS 1.0%CVE-2022-44000CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbEPSS 1.0%CVE-2025-6384HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.0%CVE-2026-47698CRITICALvm2: Sandbox Breakout Using Dangerous Host Proto MutatorsEPSS 1.0%CVE-2022-3225HIGHImproper Control of Dynamically-Managed Code Resources in budibase/budibaseEPSS 1.0%CVE-2021-23267HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.9%CVE-2023-37271HIGHRestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapeEPSS 0.8%CVE-2022-39051MEDIUMPerl Code execution in Template ToolkitEPSS 0.8%CVE-2023-5763MEDIUMGlassfish remote code executionEPSS 0.8%CVE-2026-92946CRITICALvm2 before 3.11.7 Remote Code Execution via require.externalEPSS 0.8%CVE-2025-69219HIGHApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorEPSS 0.8%CVE-2026-47131CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.8%CVE-2026-73226HIGHElecterm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlistEPSS 0.8%CVE-2021-23259MEDIUMGroovy Sandbox BypassEPSS 0.7%