Weaknesses of type CWE-913

95 results

Controle inadequado de recursos de código gerenciados dinamicamente

Fraqueza onde a aplicação carrega, executa ou modifica código em tempo de execução sem validação ou isolamento apropriado. O atacante consegue injetar ou manipular código dinâmico (scripts, bytecode, plugins) porque não há barreira de segurança entre a fonte do código e sua execução, resultando em execução de código arbitrário.

Example

Um aplicativo que carrega plugins .jar de um diretório sem verificar assinatura digital ou sandbox, permitindo que um arquivo malicioso substituído execute com os mesmos privilégios da JVM. Ou um servidor que avalia JavaScript enviado pelo cliente via eval() sem sanitização.

How to mitigate

Validar criptograficamente (hash, assinatura digital) todo código dinâmico antes de carregar; usar sandbox ou runtime restrito (AppDomains, módulos isolados) se possível; nunca usar eval() ou equivalentes com entrada não confiável; carregar código apenas de fontes pré-aprovadas com controle de acesso rigoroso.

CVE-2026-1770MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.5%CVE-2026-12354HIGHIBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injectionEPSS 0.5%CVE-2025-13426HIGHImproper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code ExecutionEPSS 0.5%CVE-2026-76023HIGHImproper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised thEPSS 0.5%CVE-2023-35930LOWLookupResources may return partial results in spicedbEPSS 0.4%CVE-2026-7381CRITICALPlack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewritingEPSS 0.4%CVE-2025-6107LOWcomfyanonymous comfyui utils.py set_attr dynamically-determined object attributesEPSS 0.4%CVE-2025-14085MEDIUMyoulaitech youlai-mall orders improper control of dynamically-identified variablesEPSS 0.4%CVE-2026-84430MEDIUMgouguoa edit_personal Endpoint Index.php update dynamically-determined object attributesEPSS 0.4%CVE-2026-92217MEDIUMa2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributesEPSS 0.4%CVE-2024-5401MEDIUMImproper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-EPSS 0.4%CVE-2023-4041CRITICALSecond Stage Gecko Bootloader GBL Parser Buffer Overrun VulnerabilityEPSS 0.4%CVE-2026-85408MEDIUMEleveo Quality Management Conversation events dynamically-determined object attributesEPSS 0.4%CVE-2026-47137CRITICALvm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCEEPSS 0.4%CVE-2025-46675LOWIn NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.EPSS 0.4%CVE-2026-108948MEDIUMcode-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributesEPSS 0.3%CVE-2026-108819MEDIUMagno-agi agno Agent Orchestration Layer exec dynamically-managed code resourcesEPSS 0.3%CVE-2021-42809MEDIUMThe Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link LibraryEPSS 0.3%CVE-2026-105180MEDIUMJeebase UserService info updateUser dynamically-determined object attributesEPSS 0.3%CVE-2026-118538MEDIUMa2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributesEPSS 0.3%