Falhas do tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

A aplicação importa ou carrega código, bibliotecas ou plugins de uma fonte que não pode ser verificada ou controlada adequadamente. Um atacante pode interceptar, modificar ou substituir esse componente externo, injetando malware ou lógica maliciosa na aplicação. O risco é crítico porque o código não confiável executa com os mesmos privilégios da aplicação.

Exemplo

Um app Node.js que baixa um módulo npm sem verificar assinatura ou hash, ou um desktop app que carrega uma DLL de um diretório acessível a usuários locais. Se o atacante conseguir colocar uma versão comprometida antes do carregamento, o código malicioso roda dentro do processo.

Como mitigar

Implemente verificação de integridade (hash criptográfico, assinatura digital) para todo código externo antes de executar. Use repositórios oficiais, versione explicitamente as dependências, bloqueie carregamento dinâmico de paths não seguros e mantenha um inventário de componentes confiáveis. Isole e revise regularmente dependências críticas.

CVE-2026-64809HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreterEPSS 0.2%CVE-2026-64808HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingEPSS 0.2%CVE-2026-64804HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingEPSS 0.2%CVE-2026-64805HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toEPSS 0.2%CVE-2026-64806HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretEPSS 0.2%CVE-2026-55697HIGHpnpm: Repository-controlled configDependencies can select a pacquet native install engineEPSS 0.2%CVE-2025-52655LOWHCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.EPSS 0.2%CVE-2026-54532MEDIUMCloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theftEPSS 0.2%CVE-2026-47781HIGHpdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI ParsingEPSS 0.2%CVE-2026-64811HIGHIn JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container confiEPSS 0.2%CVE-2026-86504HIGHIn JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executEPSS 0.2%CVE-2026-65908HIGHIn JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project openEPSS 0.2%CVE-2026-64807HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationEPSS 0.2%CVE-2026-0303LOWCheckov by Prisma Cloud: Code Execution via Auto-Loaded Configuration FileEPSS 0.2%CVE-2026-1342HIGHSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.2%CVE-2026-40959CRITICALLuanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.EPSS 0.2%CVE-2026-44358HIGHEspressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action EntrypointEPSS 0.2%CVE-2026-55487HIGHpnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycleEPSS 0.2%CVE-2026-6482HIGHLocal Privilege Escalation via OpenSSL configuration file in Insight AgentEPSS 0.2%CVE-2026-89332MEDIUMKiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationEPSS 0.2%