Falhas do tipo CWE-913

95 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

Fraqueza onde a aplicação carrega, executa ou gerencia código gerado ou modificado em tempo de execução sem validação ou isolamento adequado. O risco é que código malicioso ou injetado seja executado com privilégios da aplicação, comprometendo toda a segurança do sistema.

Exemplo

Um framework web que permite aos usuários enviar templates que são compilados e executados via eval() ou reflection sem sanitização, ou um plugin que carrega bibliotecas de fontes não confiáveis sem verificar assinatura criptográfica — ambos permitem execução de código arbitrário.

Como mitigar

Evite eval() e equivalentes; se necessário carregar código dinamicamente, use allowlists rigorosas e assinatura criptográfica. Implemente sandboxing (contextos isolados, permissões mínimas) e valide toda entrada que influencie qual código será executado.

CVE-2021-23259MEDIUMGroovy Sandbox BypassEPSS 0.7%CVE-2021-21413HIGHMisuse of `Reference` and other transferable APIs may lead to access to nodejs isolateEPSS 0.7%CVE-2026-103663MEDIUMPath Traversal leading to Remote Code Execution in OllamaEPSS 0.7%CVE-2026-92955CRITICALvm2 before 3.11.8 Sandbox Escape via NodeVMEPSS 0.7%CVE-2026-71470CRITICALAcm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saEPSS 0.7%CVE-2022-31764HIGHApache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCEPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2019-1595HIGHCisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of Service VulnerabilityEPSS 0.6%CVE-2021-23262MEDIUMSnakeyaml deserialization vulnerability bypassEPSS 0.6%CVE-2026-33286CRITICALGraphiti Affected by Arbitrary Method Execution via Unvalidated Relationship NamesEPSS 0.6%CVE-2026-92935CRITICALvm2 NodeVM Remote Code Execution via Array-Shaped RequireEPSS 0.6%CVE-2023-25560HIGHJSON Injection in DataHubEPSS 0.6%CVE-2026-44336CRITICALPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionEPSS 0.6%CVE-2025-61780MEDIUMRack has Possible Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-59283CRITICALSpring Framework Safety Guard Bypass via SpEL Expression CompilationEPSS 0.5%CVE-2026-65181HIGHApache Impala: RCE via External Data Source Class LoadingEPSS 0.5%CVE-2025-14051MEDIUMyoulaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variablesEPSS 0.5%CVE-2025-46673MEDIUMNASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space DEPSS 0.5%CVE-2026-92953CRITICALvm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArrayEPSS 0.5%