GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
4797
Downloads
6.6M
Verified
4797
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-33978: Worker Untrusted Client Id Registrationcve-2026-33978-worker-untrusted-client-id-registration

Client identifiers extracted from worker message event payloads (`event.data.clientId`) are self-reported and untrusted. Using `event.data.clientId` to register or route MessagePorts allows untrusted contexts to spoof client IDs and hijack inter-context communication. Rely on browser-verified context identifiers such as `event.source.id` in ServiceWorkers in

TSCVE-2026-33978CWE-290CWE-345
by Provallyupdated 2026-09-02Apache-2.0
1090 direct109 via packs
74
All matching rules loaded.