Fallos del tipo CWE-150

81 resultados

Neutralização inadequada de sequências de escape, meta ou controle

Ocorre quando a aplicação não remove ou valida corretamente sequências de escape, metacaracteres ou caracteres de controle em dados de entrada antes de usá-los em contextos sensíveis (como exibição em terminal, logs, ou processamento de comandos). Um atacante pode injetar sequências que alteram o comportamento esperado, burlar filtros ou executar ações não autorizadas.

Ejemplo

Um sistema de logs que recebe input do usuário sem sanitização: se o atacante injeta a sequência de escape ANSI '\x1b[31m' (vermelho), pode alterar cores do terminal; se injeta '\x08' (backspace), pode apagar caracteres anteriores do log, ocultando evidências de sua ação.

Cómo mitigar

Valide e remova sequências de controle perigosas na entrada (whitelist de caracteres permitidos é preferível); ao exibir dados em contextos sensíveis (terminal, logs, email), escapeie ou sanitize explicitamente usando funções seguras; aplique Content Security Policy e validação contextual conforme o destino dos dados.

CVE-2026-9270CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injectionsEPSS 0.3%CVE-2026-46740MEDIUMMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injectionsEPSS 0.3%CVE-2025-58160LOWTracing logging user input may result in poisoning logs with ANSI escape sequencesEPSS 0.3%CVE-2026-50637HIGHMetrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2024-56201MEDIUMJinja has a sandbox breakout through malicious filenamesEPSS 0.3%CVE-2026-46719MEDIUMNet::Statsd::Lite versions before 0.9.0 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-19591HIGHOpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe becEPSS 0.3%CVE-2026-82584LOWTerminal escape sequence injection in the mix igniter.install confirmation prompt via package metadataEPSS 0.3%CVE-2025-23026MEDIUMHTML templates containing Javascript template strings are subject to XSS in jteEPSS 0.3%CVE-2025-30089MEDIUMgurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.EPSS 0.3%CVE-2026-3108HIGHTerminal Escape Injection in mmctl Report Posts CommandEPSS 0.3%CVE-2025-1692MEDIUMMongoDB Shell may be susceptible to control character injection via pastingEPSS 0.3%CVE-2026-39879HIGHSQL injection in syslog-ng SQL destionation driverEPSS 0.3%CVE-2026-72913HIGHKitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequencesEPSS 0.3%CVE-2023-39342LOWDangerzone CLI does not sanitize ANSI escape characters EPSS 0.3%CVE-2026-50639MEDIUMMetrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2026-46741HIGHEtsy::StatsD versions through 1.002002 for Perl allow metric injectionsEPSS 0.3%CVE-2026-35651MEDIUMOpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval PromptEPSS 0.3%CVE-2026-46739MEDIUMNet::Statsd versions before 0.13 for Perl allow metric injectionsEPSS 0.3%CVE-2026-8788HIGHNet::Statsd::Lite versions through 0.10.0 for Perl allowed metric injectionsEPSS 0.2%