Fallos del tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2025-36355HIGHIBM Security Verify Access code executionEPSS 0.2%CVE-2026-54325MEDIUMPi loads project-local extensions without approvalEPSS 0.2%CVE-2025-33205HIGHNVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an unEPSS 0.2%CVE-2026-65119HIGHNVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusiEPSS 0.2%CVE-2026-1628MEDIUMMattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.EPSS 0.2%CVE-2026-59172HIGHJoker linter executed project-local .jokerd/linter.* files during lintingEPSS 0.2%CVE-2026-49986HIGHCortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`EPSS 0.2%CVE-2026-86949HIGHThis issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be aEPSS 0.2%CVE-2026-16085MEDIUMSipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphereEPSS 0.2%CVE-2026-22865HIGHGradle's failure to disable repositories failing to answer can expose builds to malicious artifactsEPSS 0.2%CVE-2025-53841HIGHThe GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.EPSS 0.2%CVE-2026-24226MEDIUMNVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploEPSS 0.2%CVE-2026-73073HIGHVim: Arbitrary Ex Command Execution in C Omni-CompletionEPSS 0.2%CVE-2024-45482HIGHPrivilege escalation in B&R APROLEPSS 0.1%CVE-2026-25931HIGHvscode-spell-checker has a workspace-trust bypass Code ExecutionEPSS 0.1%CVE-2026-45184MEDIUMKdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.EPSS 0.1%CVE-2026-123858MEDIUMIn JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsEPSS 0.1%CVE-2026-123843LOWIn JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationEPSS 0.1%CVE-2026-44312MEDIUMcss_parser allows to MITM included https css urlsEPSS 0.1%CVE-2026-123849HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersEPSS 0.1%