Weaknesses of type CWE-913

86 results

Controle inadequado de recursos de código gerenciados dinamicamente

Fraqueza onde a aplicação carrega, executa ou modifica código em tempo de execução sem validação ou isolamento apropriado. O atacante consegue injetar ou manipular código dinâmico (scripts, bytecode, plugins) porque não há barreira de segurança entre a fonte do código e sua execução, resultando em execução de código arbitrário.

Example

Um aplicativo que carrega plugins .jar de um diretório sem verificar assinatura digital ou sandbox, permitindo que um arquivo malicioso substituído execute com os mesmos privilégios da JVM. Ou um servidor que avalia JavaScript enviado pelo cliente via eval() sem sanitização.

How to mitigate

Validar criptograficamente (hash, assinatura digital) todo código dinâmico antes de carregar; usar sandbox ou runtime restrito (AppDomains, módulos isolados) se possível; nunca usar eval() ou equivalentes com entrada não confiável; carregar código apenas de fontes pré-aprovadas com controle de acesso rigoroso.

CVE-2019-1617HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityEPSS 1.3%CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2020-25802MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.EPSS 1.1%CVE-2020-25803MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.EPSS 1.1%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%CVE-2022-44000CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbEPSS 1.0%CVE-2025-6384HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.0%CVE-2022-3225HIGHImproper Control of Dynamically-Managed Code Resources in budibase/budibaseEPSS 0.9%CVE-2021-23267HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.9%CVE-2023-37271HIGHRestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapeEPSS 0.8%CVE-2022-39051MEDIUMPerl Code execution in Template ToolkitEPSS 0.8%CVE-2026-47208CRITICALvm2: Sandbox Breakout Using Promise SpeciesEPSS 0.8%CVE-2021-21413HIGHMisuse of `Reference` and other transferable APIs may lead to access to nodejs isolateEPSS 0.7%CVE-2026-47698CRITICALvm2: Sandbox Breakout Using Dangerous Host Proto MutatorsEPSS 0.7%CVE-2021-23258MEDIUMSpring SPEL Expression Language InjectionEPSS 0.7%CVE-2021-23259MEDIUMGroovy Sandbox BypassEPSS 0.7%CVE-2025-69219HIGHApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorEPSS 0.7%CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2022-31764HIGHApache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCEPSS 0.7%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.7%