Falhas do tipo CWE-470

93 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2026-24246HIGHNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourcEPSS 0.4%CVE-2025-61925MEDIUMAstro's `X-Forwarded-Host` is reflected with no validationEPSS 0.4%CVE-2026-61599HIGHdjust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathEPSS 0.4%CVE-2026-66269HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('EPSS 0.4%CVE-2026-44339HIGHPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeEPSS 0.4%CVE-2026-79987HIGHLow-privilege RCE through element-search eager loadingEPSS 0.4%CVE-2026-17593HIGHNexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationEPSS 0.4%CVE-2026-10853HIGHIBM MQ queue manager is vulnerable to remote code executionEPSS 0.4%CVE-2026-48517MEDIUMMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsEPSS 0.3%CVE-2026-57284MEDIUMJenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniEPSS 0.3%CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.3%CVE-2026-58659HIGHPyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterEPSS 0.3%CVE-2026-79784HIGHVocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model ConfigurationEPSS 0.3%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.3%CVE-2026-54614MEDIUMDebugKit: MailPreview contains unsafe reflectionEPSS 0.3%CVE-2026-53666MEDIUMReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationEPSS 0.3%CVE-2026-41175HIGHStatamic: Unsafe method invocation via query value resolution allows data destructionEPSS 0.3%CVE-2026-61536HIGHBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEEPSS 0.3%CVE-2026-64663MEDIUMStatamic: Unsafe method invocation via Antlers template resolution allows data destructionEPSS 0.3%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.3%