Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
An incomplete blocklist of unsafe modules for pickle deserialization was found. The blocklist misses stdlib modules such as `uuid`, `pkgutil`, `imaplib`, or insufficiently blocks `cProfile` and `profile`. Attackers can exploit these unblocked functions to bypass the scanner and achieve arbitrary code execution.
A session was retrieved by ID and restored/bound without checking ownership. This logic allows a session hijacking attack if an attacker supplies a victim's session ID. Verify that the session owner matches the currently authenticated user before performing the binding.
Missing strict validation of extracted filename. Verify that the extracted filename exactly matches the original input name to prevent silently ignoring path components.
A weak lexical guard against path traversal was detected. Splitting a path string and checking for literal '..' components can be bypassed by URL-encoded sequences, normalization differences, or symlink traversal. Prefer using secure path resolution methods like `os.path.abspath(path).startswith(required_root)` or `pathlib.Path.resolve()` to safely validate
DigestAuthMiddleware does not restrict credentials to the original scoped origin, leading to potential credential leakage to attacker-controlled origins during redirects.
PythonCVE-2026-54276The HTTP/1 request parsing implementation lacks a boundary limit on the number of pipelined requests. The parser continuously processes socket data into parsed request messages and buffers them indefinitely in memory without applying backpressure.
PythonCVE-2026-54273Unbounded audio decoding detected. An attacker can provide a highly compressed audio file (decompression bomb) that expands into gigabytes of raw PCM data, leading to memory exhaustion and Denial of Service. Limit the maximal amount of frames, samples, or duration decoded, and exit early if limits are exceeded.
Found an incomplete blocklist of unsafe modules for pickle scanning. `cProfile` or `profile` only block specific methods, missing other arbitrary execution vectors.
PythonCVE-2026-53874The `profile` module blocklist is incomplete. It fails to block the module-level `profile.run` and `profile.runctx` functions, allowing attackers to achieve arbitrary code execution via exec() when unpickled.
A module blocklist meant for Python deserialization scanning appears to be incomplete. Omitting dangerous modules like `pkgutil` (which can resolve any module dynamically, bypassing blocklists) or command-execution vectors in `uuid`, `test`, and `imaplib` allows attackers to bypass inspection. Ensure the blocklist maps modules such as `pkgutil`, `uuid`, `tes
Unvalidated dictionary keys in query-parsing are directly formatted into `frappe.throw`, which can lead to Stored XSS or SQL injection. Ensure uppercase functions/keys are validated (e.g., using `child_field.isupper()`) before throwing errors.
Constructing shell commands by substituting string placeholders with unquoted variables via `str.replace()` can lead to OS command injection. Ensure replacements use `shlex.quote()` to escape the injected values before passing the command to subprocess.
PythonCVE-2026-52726A debug print statement directly outputting the contents of a file to standard output. If this file contains sensitive data (like cookies), this can lead to information disclosure via logs or console output.
A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists. A path is checked for its type (e.g., using `is_dir()`) and subsequently deleted using a vulnerable unanchored operation such as `shutil.rmtree()` or `unlink()`. An attacker can substitute the path with a symlink between the check and the deletion, leading to arbitrary file deletion outside intended
Checking whether a path is a directory and conditionally deleting it using unanchored deletion methods (`shutil.rmtree`, `.unlink()`, `os.remove`) creates a Time-of-Check Time-of-Use (TOCTOU) race condition. If an attacker swaps a parent directory with a symlink between the check and the deletion call, arbitrary files and directories outside the intended bou
Tornado framework's error handling accepts and processes custom HTTP reason phrases without sufficient validation against Control Characters like CRLF (leading to HTTP Header Injection) or escaping before embedding into HTML response bodies (Cross-Site Scripting). Ensure that custom reason phrases are properly validated (e.g., matching a strict ABNF token pa
Constructing OS commands using string formatting or concatenation and executing them in a shell is vulnerable to command injection. An attacker can inject arbitrary shell commands. Use a list of arguments with subprocess.run() without shell=True instead.
Constructing shell commands using string formatting or concatenation and passing them to `os.system()` can lead to OS command injection. An attacker could inject arbitrary shell commands through the interpolated variables. Instead, use `subprocess.run()` and pass arguments as a list to avoid shell interpretation.
Using `URL(scope=...).path` for path evaluation in ASGI middleware is vulnerable to Host header injection, enabling path parsing confusion. This allows attackers to bypass path-based routing, authentication, or authorization logic by injecting URL characters like `?` into the Host header. Direct your checks against the raw ASGI request path from the scope us
Extracting a file path from a user-supplied URL and verifying only its existence allows path traversal and arbitrary local file reads. Path input extracted from untrusted URLs must be defensively normalized using `os.path.abspath` and verified against an explicit allowlist before being trusted.
Deserializing the output of a dynamically retrieved method using `json.loads` can cause massive memory expansion (Out-Of-Memory crashes) if the method generates large strings, such as `to_json()` on mapped data structures like Pandas DataFrames. Instead of round-tripping through JSON strings locally, rely on APIs that return serializable objects directly.
String or list multiplication with dynamically calculated values may lead to uncontrolled memory consumption and Denial of Service (DoS). Ensure the sequence multiplier is explicitly bounded before execution.
Executing OS commands with dynamic string formatting via os.system or subprocess with shell=True is vulnerable to command injection. An attacker who controls the interpolated input can break out of the command string to execute arbitrary code. Use subprocess functions without shell=True and pass arguments as an array/list.
Format string or concatenation used to construct an OS shell command opens the application to command injection. Provide parameters as a list array instead and disable shell=True.
