Fallos del tipo CWE-150

93 resultados

Neutralização inadequada de sequências de escape, meta ou controle

Ocorre quando a aplicação não remove ou valida corretamente sequências de escape, metacaracteres ou caracteres de controle em dados de entrada antes de usá-los em contextos sensíveis (como exibição em terminal, logs, ou processamento de comandos). Um atacante pode injetar sequências que alteram o comportamento esperado, burlar filtros ou executar ações não autorizadas.

Ejemplo

Um sistema de logs que recebe input do usuário sem sanitização: se o atacante injeta a sequência de escape ANSI '\x1b[31m' (vermelho), pode alterar cores do terminal; se injeta '\x08' (backspace), pode apagar caracteres anteriores do log, ocultando evidências de sua ação.

Cómo mitigar

Valide e remova sequências de controle perigosas na entrada (whitelist de caracteres permitidos é preferível); ao exibir dados em contextos sensíveis (terminal, logs, email), escapeie ou sanitize explicitamente usando funções seguras; aplique Content Security Policy e validação contextual conforme o destino dos dados.

CVE-2026-81856LOWTerminal escape sequence injection in Hex via unneutralized server-supplied outputEPSS 0.4%CVE-2026-73035MEDIUMnpm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape SequencesEPSS 0.4%CVE-2026-46720HIGHNet::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-50638CRITICALMetrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2025-58160LOWTracing logging user input may result in poisoning logs with ANSI escape sequencesEPSS 0.3%CVE-2026-102601LOWFlysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterEPSS 0.3%CVE-2026-21439LOWbadkeys vulnerable to ASCII control character injection on console via malformed inputEPSS 0.3%CVE-2026-9270CRITICALDataDog::DogStatsd versions through 0.07 for Perl allow metric injectionsEPSS 0.3%CVE-2026-46740MEDIUMMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injectionsEPSS 0.3%CVE-2026-50637HIGHMetrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2024-56201MEDIUMJinja has a sandbox breakout through malicious filenamesEPSS 0.3%CVE-2026-46719MEDIUMNet::Statsd::Lite versions before 0.9.0 for Perl allowed metric injectionsEPSS 0.3%CVE-2025-23026MEDIUMHTML templates containing Javascript template strings are subject to XSS in jteEPSS 0.3%CVE-2025-30089MEDIUMgurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.EPSS 0.3%CVE-2026-3108HIGHTerminal Escape Injection in mmctl Report Posts CommandEPSS 0.3%CVE-2025-1692MEDIUMMongoDB Shell may be susceptible to control character injection via pastingEPSS 0.3%CVE-2026-39879HIGHSQL injection in syslog-ng SQL destionation driverEPSS 0.3%CVE-2023-39342LOWDangerzone CLI does not sanitize ANSI escape characters EPSS 0.3%CVE-2026-50639MEDIUMMetrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injectionsEPSS 0.3%CVE-2026-46741HIGHEtsy::StatsD versions through 1.002002 for Perl allow metric injectionsEPSS 0.3%