Falhas do tipo CWE-913

95 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

Fraqueza onde a aplicação carrega, executa ou gerencia código gerado ou modificado em tempo de execução sem validação ou isolamento adequado. O risco é que código malicioso ou injetado seja executado com privilégios da aplicação, comprometendo toda a segurança do sistema.

Exemplo

Um framework web que permite aos usuários enviar templates que são compilados e executados via eval() ou reflection sem sanitização, ou um plugin que carrega bibliotecas de fontes não confiáveis sem verificar assinatura criptográfica — ambos permitem execução de código arbitrário.

Como mitigar

Evite eval() e equivalentes; se necessário carregar código dinamicamente, use allowlists rigorosas e assinatura criptográfica. Implemente sandboxing (contextos isolados, permissões mínimas) e valide toda entrada que influencie qual código será executado.

CVE-2024-2537MEDIUMElectron Code Injection in Logi Tune macOS ApplicationEPSS 0.3%CVE-2025-6705HIGHA vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. SpecifEPSS 0.3%CVE-2025-14695MEDIUMSamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resourcesEPSS 0.3%CVE-2026-121170HIGHImproper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a cEPSS 0.3%CVE-2026-5251MEDIUMz-9527 admin User Update Endpoint user.js dynamically-determined object attributesEPSS 0.2%CVE-2026-5248MEDIUMgougucms User Registration Login.php reg_submit dynamically-determined object attributesEPSS 0.2%CVE-2026-48775MEDIUMLangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loadingEPSS 0.2%CVE-2026-116612HIGHA flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline descriptEPSS 0.2%CVE-2026-48105HIGHArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitiveEPSS 0.2%CVE-2025-9905HIGHArbitary Code execution in Keras load_model()EPSS 0.2%CVE-2026-62848HIGHMetalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code executionEPSS 0.2%CVE-2026-48700CRITICALAn issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktEPSS 0.2%CVE-2025-54065HIGHGZDoom engine allows arbitrary code execution via ZScript actor statesEPSS 0.1%CVE-2025-26405MEDIUMImproper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of EPSS 0.1%CVE-2026-102734MEDIUMasteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval InterpreterEPSS 0.1%