Falhas do tipo CWE-913

86 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

Fraqueza onde a aplicação carrega, executa ou gerencia código gerado ou modificado em tempo de execução sem validação ou isolamento adequado. O risco é que código malicioso ou injetado seja executado com privilégios da aplicação, comprometendo toda a segurança do sistema.

Exemplo

Um framework web que permite aos usuários enviar templates que são compilados e executados via eval() ou reflection sem sanitização, ou um plugin que carrega bibliotecas de fontes não confiáveis sem verificar assinatura criptográfica — ambos permitem execução de código arbitrário.

Como mitigar

Evite eval() e equivalentes; se necessário carregar código dinamicamente, use allowlists rigorosas e assinatura criptográfica. Implemente sandboxing (contextos isolados, permissões mínimas) e valide toda entrada que influencie qual código será executado.

CVE-2019-1617HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityEPSS 1.3%CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2020-25802MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.EPSS 1.1%CVE-2020-25803MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.EPSS 1.1%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%CVE-2022-44000CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbEPSS 1.0%CVE-2025-6384HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.0%CVE-2022-3225HIGHImproper Control of Dynamically-Managed Code Resources in budibase/budibaseEPSS 0.9%CVE-2021-23267HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.9%CVE-2023-37271HIGHRestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapeEPSS 0.8%CVE-2022-39051MEDIUMPerl Code execution in Template ToolkitEPSS 0.8%CVE-2026-47208CRITICALvm2: Sandbox Breakout Using Promise SpeciesEPSS 0.8%CVE-2021-21413HIGHMisuse of `Reference` and other transferable APIs may lead to access to nodejs isolateEPSS 0.7%CVE-2026-47698CRITICALvm2: Sandbox Breakout Using Dangerous Host Proto MutatorsEPSS 0.7%CVE-2021-23258MEDIUMSpring SPEL Expression Language InjectionEPSS 0.7%CVE-2021-23259MEDIUMGroovy Sandbox BypassEPSS 0.7%CVE-2025-69219HIGHApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorEPSS 0.7%CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2022-31764HIGHApache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCEPSS 0.7%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.7%