Falhas do tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

A aplicação importa ou carrega código, bibliotecas ou plugins de uma fonte que não pode ser verificada ou controlada adequadamente. Um atacante pode interceptar, modificar ou substituir esse componente externo, injetando malware ou lógica maliciosa na aplicação. O risco é crítico porque o código não confiável executa com os mesmos privilégios da aplicação.

Exemplo

Um app Node.js que baixa um módulo npm sem verificar assinatura ou hash, ou um desktop app que carrega uma DLL de um diretório acessível a usuários locais. Se o atacante conseguir colocar uma versão comprometida antes do carregamento, o código malicioso roda dentro do processo.

Como mitigar

Implemente verificação de integridade (hash criptográfico, assinatura digital) para todo código externo antes de executar. Use repositórios oficiais, versione explicitamente as dependências, bloqueie carregamento dinâmico de paths não seguros e mantenha um inventário de componentes confiáveis. Isole e revise regularmente dependências críticas.

CVE-2026-62222HIGHOpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-modeEPSS 0.2%CVE-2026-58569HIGHDell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited priviEPSS 0.2%CVE-2025-49809HIGHmtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: EPSS 0.2%CVE-2026-22816HIGHGradle fails to disable repositories which can expose builds to malicious artifactsEPSS 0.2%CVE-2026-42089HIGHyeoman-environment Vulnerable to Arbitrary Package Installation without User ConfirmationEPSS 0.2%CVE-2026-8426HIGHConcrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwriteEPSS 0.2%CVE-2026-7373HIGHMetasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File LoadingEPSS 0.2%CVE-2026-17647HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-43940HIGHelecterm: Path traversal in electerm runWidget leads to arbitrary code executionEPSS 0.2%CVE-2025-36355HIGHIBM Security Verify Access code executionEPSS 0.2%CVE-2025-33205HIGHNVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an unEPSS 0.2%CVE-2026-54325MEDIUMPi loads project-local extensions without approvalEPSS 0.2%CVE-2026-65119HIGHNVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusiEPSS 0.2%CVE-2026-1628MEDIUMMattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.EPSS 0.2%CVE-2026-59172HIGHJoker linter executed project-local .jokerd/linter.* files during lintingEPSS 0.2%CVE-2026-86949HIGHThis issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be aEPSS 0.2%CVE-2026-49986HIGHCortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`EPSS 0.2%CVE-2026-16085MEDIUMSipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphereEPSS 0.2%CVE-2026-22865HIGHGradle's failure to disable repositories failing to answer can expose builds to malicious artifactsEPSS 0.2%CVE-2025-53841HIGHThe GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.EPSS 0.2%