Weaknesses of type CWE-913

95 results

Controle inadequado de recursos de código gerenciados dinamicamente

Fraqueza onde a aplicação carrega, executa ou modifica código em tempo de execução sem validação ou isolamento apropriado. O atacante consegue injetar ou manipular código dinâmico (scripts, bytecode, plugins) porque não há barreira de segurança entre a fonte do código e sua execução, resultando em execução de código arbitrário.

Example

Um aplicativo que carrega plugins .jar de um diretório sem verificar assinatura digital ou sandbox, permitindo que um arquivo malicioso substituído execute com os mesmos privilégios da JVM. Ou um servidor que avalia JavaScript enviado pelo cliente via eval() sem sanitização.

How to mitigate

Validar criptograficamente (hash, assinatura digital) todo código dinâmico antes de carregar; usar sandbox ou runtime restrito (AppDomains, módulos isolados) se possível; nunca usar eval() ou equivalentes com entrada não confiável; carregar código apenas de fontes pré-aprovadas com controle de acesso rigoroso.

CVE-2021-23259MEDIUMGroovy Sandbox BypassEPSS 0.7%CVE-2021-21413HIGHMisuse of `Reference` and other transferable APIs may lead to access to nodejs isolateEPSS 0.7%CVE-2026-103663MEDIUMPath Traversal leading to Remote Code Execution in OllamaEPSS 0.7%CVE-2026-92955CRITICALvm2 before 3.11.8 Sandbox Escape via NodeVMEPSS 0.7%CVE-2026-71470CRITICALAcm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saEPSS 0.7%CVE-2022-31764HIGHApache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCEPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2019-1595HIGHCisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of Service VulnerabilityEPSS 0.6%CVE-2021-23262MEDIUMSnakeyaml deserialization vulnerability bypassEPSS 0.6%CVE-2026-33286CRITICALGraphiti Affected by Arbitrary Method Execution via Unvalidated Relationship NamesEPSS 0.6%CVE-2026-92935CRITICALvm2 NodeVM Remote Code Execution via Array-Shaped RequireEPSS 0.6%CVE-2023-25560HIGHJSON Injection in DataHubEPSS 0.6%CVE-2026-44336CRITICALPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionEPSS 0.6%CVE-2025-61780MEDIUMRack has Possible Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-59283CRITICALSpring Framework Safety Guard Bypass via SpEL Expression CompilationEPSS 0.5%CVE-2026-65181HIGHApache Impala: RCE via External Data Source Class LoadingEPSS 0.5%CVE-2025-14051MEDIUMyoulaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variablesEPSS 0.5%CVE-2025-46673MEDIUMNASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space DEPSS 0.5%CVE-2026-92953CRITICALvm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArrayEPSS 0.5%