Falhas do tipo CWE-470

127 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2026-92206HIGHCrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-46718MEDIUMApache Calcite: A user-controled model can load arbitrary classes, leading to code executionEPSS 0.4%CVE-2026-24246HIGHNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourcEPSS 0.4%CVE-2026-119050CRITICALAgno through 3.1.11 Code Execution via PandasTools Unsafe ReflectionEPSS 0.4%CVE-2026-112145MEDIUMspeaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or codeEPSS 0.4%CVE-2026-78030CRITICALDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMEPSS 0.4%CVE-2026-53666MEDIUMReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationEPSS 0.4%CVE-2025-61925MEDIUMAstro's `X-Forwarded-Host` is reflected with no validationEPSS 0.4%CVE-2026-96740MEDIUMStreamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providersEPSS 0.4%CVE-2026-114508MEDIUMLaravel relationship inclusion can trigger unauthorized data destructionEPSS 0.4%CVE-2026-64663MEDIUMStatamic: Unsafe method invocation via Antlers template resolution allows data destructionEPSS 0.4%CVE-2026-71253CRITICALApache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSONEPSS 0.4%CVE-2026-105782HIGHScrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddlewareEPSS 0.4%CVE-2026-96672MEDIUMFrappe ERPNext before 16.34.1 Unauthorized Method InvocationEPSS 0.4%CVE-2026-61536HIGHBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEEPSS 0.4%CVE-2026-44339HIGHPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeEPSS 0.4%CVE-2026-48517MEDIUMMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsEPSS 0.3%CVE-2026-13187HIGHDialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.3%CVE-2017-20285CRITICALYAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classesEPSS 0.3%