Fallos del tipo CWE-506

103 resultados

Código malicioso incorporado

É quando código malicioso é deliberadamente inserido dentro de um software legítimo durante o desenvolvimento, compilação ou distribuição. O atacante consegue executar ações não autorizadas (roubo de dados, backdoors, sabotagem) porque o código malicioso está embutido no binário confiável.

Ejemplo

Um desenvolvedor com acesso ao repositório insere silenciosamente código que envia credenciais de usuários para um servidor externo; ou um fornecedor de biblioteca terceira injeta um keylogger que ativa após a instalação. A vítima só descobre quando o dano já está feito.

Cómo mitigar

Implemente: (1) revisão de código rigorosa e assinatura digital de commits; (2) análise estática e dinâmica automática (SAST/DAST) no pipeline CI/CD; (3) verificação de integridade e autenticidade de dependências e pacotes; (4) auditoria de acessos a repositórios e build systems; (5) sandboxing e princípio de menor privilégio em produção.

CVE-2026-77651CRITICALThe arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a roEPSS 0.8%CVE-2026-66747CRITICALENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root ImplantEPSS 0.8%CVE-2026-46412CRITICALMalicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud wormEPSS 0.8%CVE-2026-67595CRITICALVaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.phpEPSS 0.8%CVE-2017-16207—discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.EPSS 0.7%CVE-2026-48160CRITICALreact-tracked was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-48161CRITICALreact18-use was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-48159CRITICALuse-reducer-async was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-48158CRITICALuse-context-selector was vulnerable to malicious code execution via compromised commitsEPSS 0.7%CVE-2026-73532CRITICALFluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin BuildEPSS 0.7%CVE-2017-20203CRITICALNetSarang v5.0 Malicious Backdoor Supply Chain CompromiseEPSS 0.7%CVE-2026-111862CRITICALRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeEPSS 0.7%CVE-2026-73533CRITICALNinja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin BuildEPSS 0.6%CVE-2026-31976CRITICALxygeni-action v5 tag poisoned with C2 backdoorEPSS 0.6%CVE-2025-10894CRITICALNx: nx/devkit: malicious versions of nx and plugins published to npmEPSS 0.6%CVE-2026-34424CRITICALSmart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitEPSS 0.6%CVE-2025-59145HIGHcolor-name@2.0.1 contains malware after npm account takeoverEPSS 0.6%CVE-2017-20202CRITICALWeb Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain CompromiseEPSS 0.5%CVE-2017-20201CRITICALCCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain CompromiseEPSS 0.5%CVE-2026-46421CRITICALSupply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)EPSS 0.5%