Fallos del tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2026-123849HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersEPSS 0.1%CVE-2026-48124HIGHCursor Desktop sandbox escape via Claude hook configurationEPSS 0.1%CVE-2026-123308MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projectsEPSS 0.1%CVE-2026-96269HIGHGNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affectEPSS 0.1%CVE-2026-15564HIGHWildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserializationEPSS 0.1%CVE-2026-66141HIGHExim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.EPSS 0.1%CVE-2026-95649MEDIUMIRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code executionEPSS 0.1%CVE-2026-6357MEDIUMpip self-update functionality can import newly installed modules after wheel installationEPSS 0.1%CVE-2026-44995MEDIUMOpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment VariablesEPSS 0.1%CVE-2026-111091HIGHIn JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configurationEPSS 0.1%CVE-2026-95985HIGHKiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted WorkspacesEPSS 0.1%CVE-2026-73076HIGHVim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`EPSS 0.1%CVE-2025-69257MEDIUMtheshit vulnerable to unsafe loading of user-owned Python rules when running as root.EPSS 0.1%CVE-2026-100256HIGHIn JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projectsEPSS 0.1%CVE-2026-41336HIGHOpenClaw < 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable OverrideEPSS 0.1%CVE-2026-22217MEDIUMOpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix FallbackEPSS 0.1%CVE-2026-8428HIGHCSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and belowEPSS 0.1%CVE-2026-41295HIGHOpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel SetupEPSS 0.1%CVE-2025-57729MEDIUMIn JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server startEPSS 0.1%CVE-2026-12057HIGHDoS + Remote Code Execution via PDF JavaScript in Foxit AIEPSS 0.1%