Fallos del tipo CWE-829

242 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2026-4295HIGHArbitrary code execution via crafted project files in Kiro IDEEPSS 0.2%CVE-2026-27615HIGHADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE)EPSS 0.2%CVE-2026-13751MEDIUMSnowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!loadEPSS 0.2%CVE-2022-49038HIGHInclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 EPSS 0.2%CVE-2026-52858HIGHVim: Arbitrary Code Execution via Python Omni-CompletionEPSS 0.2%CVE-2026-41253MEDIUMIn iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains aEPSS 0.2%CVE-2024-52976MEDIUMElastic Agent Inclusion of Functionality from Untrusted Control SphereEPSS 0.2%CVE-2026-3991HIGHElevation of Privileges in Symantec Data Loss Prevention Windows EndpointEPSS 0.2%CVE-2026-81305HIGHCareCam CM2507 Inclusion of Functionality from Untrusted Control SphereEPSS 0.2%CVE-2026-57860HIGHForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted RepositoryEPSS 0.2%CVE-2026-64809HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreterEPSS 0.2%CVE-2026-64806HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretEPSS 0.2%CVE-2026-64805HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toEPSS 0.2%CVE-2026-64804HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingEPSS 0.2%CVE-2026-64808HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingEPSS 0.2%CVE-2026-55697HIGHpnpm: Repository-controlled configDependencies can select a pacquet native install engineEPSS 0.2%CVE-2026-4255HIGHDLL Injection Privilege EscalationEPSS 0.2%CVE-2025-52655LOWHCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.EPSS 0.2%CVE-2025-54558MEDIUMOpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.EPSS 0.2%CVE-2026-64807HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationEPSS 0.2%