Weaknesses of type CWE-913

86 results

Controle inadequado de recursos de código gerenciados dinamicamente

Fraqueza onde a aplicação carrega, executa ou modifica código em tempo de execução sem validação ou isolamento apropriado. O atacante consegue injetar ou manipular código dinâmico (scripts, bytecode, plugins) porque não há barreira de segurança entre a fonte do código e sua execução, resultando em execução de código arbitrário.

Example

Um aplicativo que carrega plugins .jar de um diretório sem verificar assinatura digital ou sandbox, permitindo que um arquivo malicioso substituído execute com os mesmos privilégios da JVM. Ou um servidor que avalia JavaScript enviado pelo cliente via eval() sem sanitização.

How to mitigate

Validar criptograficamente (hash, assinatura digital) todo código dinâmico antes de carregar; usar sandbox ou runtime restrito (AppDomains, módulos isolados) se possível; nunca usar eval() ou equivalentes com entrada não confiável; carregar código apenas de fontes pré-aprovadas com controle de acesso rigoroso.

CVE-2023-5763MEDIUMGlassfish remote code executionEPSS 0.7%CVE-2026-33286CRITICALGraphiti Affected by Arbitrary Method Execution via Unvalidated Relationship NamesEPSS 0.6%CVE-2023-25560HIGHJSON Injection in DataHubEPSS 0.6%CVE-2021-23262MEDIUMSnakeyaml deserialization vulnerability bypassEPSS 0.6%CVE-2026-44336CRITICALPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionEPSS 0.6%CVE-2026-47131CRITICALvm2: Sandbox EscapeEPSS 0.6%CVE-2026-92955CRITICALvm2 before 3.11.8 Sandbox Escape via NodeVMEPSS 0.6%CVE-2019-1595HIGHCisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of Service VulnerabilityEPSS 0.6%CVE-2026-92946CRITICALvm2 before 3.11.7 Remote Code Execution via require.externalEPSS 0.6%CVE-2026-65181HIGHApache Impala: RCE via External Data Source Class LoadingEPSS 0.6%CVE-2025-61780MEDIUMRack has Possible Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.5%CVE-2026-92935CRITICALvm2 NodeVM Remote Code Execution via Array-Shaped RequireEPSS 0.5%CVE-2025-46673MEDIUMNASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space DEPSS 0.5%CVE-2025-14051MEDIUMyoulaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variablesEPSS 0.5%CVE-2026-76023HIGHImproper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised thEPSS 0.5%CVE-2026-1770MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.5%CVE-2026-12354HIGHIBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injectionEPSS 0.5%CVE-2023-35930LOWLookupResources may return partial results in spicedbEPSS 0.4%CVE-2026-7381CRITICALPlack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewritingEPSS 0.4%