Fallos del tipo CWE-184
197 resultadosLista incompleta de entradas bloqueadas
Ocorre quando o desenvolvedor cria uma lista de padrões ou caracteres proibidos, mas deixa de fora alguns que também deveriam estar ali. Atacantes exploram as entradas não bloqueadas para contornar a validação e injetar código malicioso ou dados malformados.
Ejemplo
Um formulário bloqueia caracteres como '<' e '>' para prevenir XSS, mas esquece de bloquear aspas duplas e eventos JavaScript embutidos. Um atacante injeta onclick="alert('pwned')" e a validação deixa passar.
Cómo mitigar
Use abordagem whitelist (aceitar só o que é válido) em vez de blacklist (bloquear o que é ruim). Se precisar de blacklist, revise frequentemente a lista e teste contra vetores conhecidos. Melhor ainda: sanitize a entrada conforme o contexto onde será usada (HTML, SQL, URL, etc).
CVE-2026-43584HIGHOpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec PolicyEPSS 0.4%CVE-2026-55743CRITICALOpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command executionEPSS 0.4%CVE-2026-63671HIGH@nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configurationEPSS 0.4%CVE-2026-74886CRITICALopenssl_encrypt before 1.4.0 Plugin Import Guard BypassEPSS 0.4%CVE-2026-34177CRITICALVM lowlevel restriction bypass via raw.apparmor and raw.qemu.confEPSS 0.4%CVE-2026-44115HIGHOpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec AllowlistEPSS 0.4%CVE-2026-40893HIGHGotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveEPSS 0.3%CVE-2026-59929MEDIUMMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionEPSS 0.3%CVE-2026-31992HIGHOpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -SEPSS 0.3%CVE-2026-45066LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationEPSS 0.3%CVE-2026-45753LOWSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)EPSS 0.3%CVE-2026-73078HIGHVim: Arbitrary Code Execution via Netrw Menu ConstructionEPSS 0.3%CVE-2026-84370HIGHSVGO: removeScripts allows executable links through namespace and control-character bypassesEPSS 0.3%CVE-2026-22175HIGHOpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell WrappersEPSS 0.3%CVE-2026-53944MEDIUMGhost: Private IP filtering bypass to make server-side requests to internal servicesEPSS 0.3%CVE-2026-56777MEDIUMn8n - AST Validator Bypass in Python Code NodeEPSS 0.3%CVE-2026-16129MEDIUMprincezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklistEPSS 0.3%CVE-2026-76072HIGHContinue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto ModeEPSS 0.3%CVE-2026-86199HIGHPocketMine-MP before 5.43.1 Denial of Service via unauthenticated loginEPSS 0.3%CVE-2026-82536HIGHRoo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe OperatorEPSS 0.3%