Falhas do tipo CWE-913

86 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

Fraqueza onde a aplicação carrega, executa ou gerencia código gerado ou modificado em tempo de execução sem validação ou isolamento adequado. O risco é que código malicioso ou injetado seja executado com privilégios da aplicação, comprometendo toda a segurança do sistema.

Exemplo

Um framework web que permite aos usuários enviar templates que são compilados e executados via eval() ou reflection sem sanitização, ou um plugin que carrega bibliotecas de fontes não confiáveis sem verificar assinatura criptográfica — ambos permitem execução de código arbitrário.

Como mitigar

Evite eval() e equivalentes; se necessário carregar código dinamicamente, use allowlists rigorosas e assinatura criptográfica. Implemente sandboxing (contextos isolados, permissões mínimas) e valide toda entrada que influencie qual código será executado.

CVE-2023-5763MEDIUMGlassfish remote code executionEPSS 0.7%CVE-2026-33286CRITICALGraphiti Affected by Arbitrary Method Execution via Unvalidated Relationship NamesEPSS 0.6%CVE-2023-25560HIGHJSON Injection in DataHubEPSS 0.6%CVE-2021-23262MEDIUMSnakeyaml deserialization vulnerability bypassEPSS 0.6%CVE-2026-44336CRITICALPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionEPSS 0.6%CVE-2026-47131CRITICALvm2: Sandbox EscapeEPSS 0.6%CVE-2026-92955CRITICALvm2 before 3.11.8 Sandbox Escape via NodeVMEPSS 0.6%CVE-2019-1595HIGHCisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of Service VulnerabilityEPSS 0.6%CVE-2026-92946CRITICALvm2 before 3.11.7 Remote Code Execution via require.externalEPSS 0.6%CVE-2026-65181HIGHApache Impala: RCE via External Data Source Class LoadingEPSS 0.6%CVE-2025-61780MEDIUMRack has Possible Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.5%CVE-2026-92935CRITICALvm2 NodeVM Remote Code Execution via Array-Shaped RequireEPSS 0.5%CVE-2025-46673MEDIUMNASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space DEPSS 0.5%CVE-2025-14051MEDIUMyoulaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variablesEPSS 0.5%CVE-2026-76023HIGHImproper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised thEPSS 0.5%CVE-2026-1770MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.5%CVE-2026-12354HIGHIBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injectionEPSS 0.5%CVE-2023-35930LOWLookupResources may return partial results in spicedbEPSS 0.4%CVE-2026-7381CRITICALPlack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewritingEPSS 0.4%