Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The MkDocs configuration sanitizer allowlist contains 'extra_templates'. MkDocs consumes extra_templates entries as arbitrary template file paths (not restricted to docs_dir) and renders them with its non-sandboxed Jinja2 engine during `mkdocs build`. Preserving this key from an untrusted, repo-committed mkdocs.yml defeats the sanitizer (CVE-2026-25153 harde
$FUNC implements a validation/authorization gate as a denylist: an enumerated set of values returns false and the switch default branch returns true, so every unlisted, unknown, or future value is accepted as valid. If the classified value shares an integer or type namespace with privileged operations (task types, message kinds, opcodes), an attacker can sub
Reflection-based struct sanitization copies fields matching an allowlist without validating or sanitizing nested struct fields. If an allowed field is a complex struct or pointer containing security-sensitive parameters, those parameters will bypass sanitization. Ensure nested fields are explicitly sanitized or stripped after top-level copying.
