GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-116576: Js Unwhitelisted Data Interpolated Into Shell Commandcve-2026-116576-js-unwhitelisted-data-interpolated-into-shell-command

Caller-controlled data reaches the command text of a PowerShell execution without allow-list (whitelist) neutralization. PowerShell - unlike a POSIX shell - normalizes Unicode typographic quotes (U+2018-U+201E) and dashes (U+2013-U+2015) into real string delimiters, so a character blacklist that strips ASCII metacharacters still leaves alternate delimiter gl

JSNode.jsCVE-2026-116576CWE-78
by Provallyupdated 2026-10-27Apache-2.0
470 direct47 via packs
86
All matching rules loaded.