GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
2917
Downloads
3.6M
Verified
2917
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
2 rules matched. Showing 2 loaded rules.
Publish rule
CVE-2026-47140: Node Module Denylist Bypasscve-2026-47140-node-module-denylist-bypass

Exact string matching against a denylist or allowlist of Node.js modules can be bypassed by using the `node:` URL scheme prefix or by requesting module subpaths (e.g., `module/subpath`). Ensure that module names are normalized by stripping the `node:` prefix and splitting on `/` to extract the core module name before checking the list.

JSNode.jsCVE-2026-47140CWE-184
by Provallyupdated 2026-06-12Apache-2.0
5130 direct513 via packs
78
CVE-2026-47140: Incomplete Node Module Denylistcve-2026-47140-incomplete-node-module-denylist

A denylist checking for dangerous Node.js modules is potentially incomplete. Node.js module resolution allows bypassing exact-match denylists using the 'node:' URL prefix or by resolving subpaths (e.g., 'inspector/promises'). Additionally, ensure 'process' and other host-exposing primitives are blocked.

JSCVE-2026-47140CWE-184CWE-693
by Provallyupdated 2026-06-23Apache-2.0
8600 direct860 via packs
77
All matching rules loaded.