Falhas do tipo CWE-184

237 resultados

Lista incompleta de entradas bloqueadas

Quando um aplicativo tenta bloquear entradas perigosas (como caracteres especiais, palavras-chave ou padrões maliciosos), mas a lista de bloqueio é incompleta ou mal pensada, um atacante consegue contornar a proteção usando variações não previstas. É a falsa sensação de segurança: o desenvolvedor acredita estar protegido, mas deixa brechas.

Exemplo

Um formulário web bloqueia a palavra 'script' para evitar XSS, mas não bloqueia 'sCrIpT' com letras maiúsculas, ou '\x3cscript' em hexadecimal. Um atacante injeta uma dessas variações e consegue executar JavaScript malicioso, burlando a proteção.

Como mitigar

Em vez de manter listas de bloqueio (blacklist), use whitelist: aceite apenas entradas conhecidas como seguras, validate com regex rigorosa e, quando possível, escape ou sanitize output com bibliotecas consolidadas (DOMPurify, OWASP, etc). Prefira validação estruturada sobre verificações ad-hoc.

CVE-2026-90808MEDIUMHKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklistEPSS 0.4%CVE-2026-42435HIGHOpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment InjectionEPSS 0.4%CVE-2026-34430HIGHByteDance DeerFlow LocalSandboxProvider Host Bash EscapeEPSS 0.4%CVE-2024-28246MEDIUMKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocolsEPSS 0.4%CVE-2026-62676HIGHOmnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.pyEPSS 0.4%CVE-2026-61788HIGH@bytebase/dbhub's read-only mode does not prevent database writesEPSS 0.4%CVE-2026-47389HIGHMastodon: SSRF protection bypass on older Ruby versionsEPSS 0.4%CVE-2026-73491LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesEPSS 0.4%CVE-2026-73492LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsEPSS 0.4%CVE-2026-22608HIGHFickling vulnerable to use of ctypes and pydoc gadget chain to bypass detectionEPSS 0.4%CVE-2026-43584HIGHOpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec PolicyEPSS 0.4%CVE-2026-76072HIGHContinue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto ModeEPSS 0.4%CVE-2026-55743CRITICALOpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command executionEPSS 0.4%CVE-2026-72860MEDIUM9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is UnreachableEPSS 0.4%CVE-2026-114729MEDIUMRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMILEPSS 0.4%CVE-2026-72779HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectEPSS 0.4%CVE-2026-114728MEDIUMRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributesEPSS 0.4%CVE-2026-45741HIGHGotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesEPSS 0.4%CVE-2026-102828CRITICALsimple-git unsafe-operation guard does not block trailer command configurationEPSS 0.4%CVE-2026-108471HIGHWindows Virtualization-Based Security (VBS) Enclave Elevation of Privilege VulnerabilityEPSS 0.4%