Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The `profile` module blocklist is incomplete. It fails to block the module-level `profile.run` and `profile.runctx` functions, allowing attackers to achieve arbitrary code execution via exec() when unpickled.
Exact string matching against a denylist or allowlist of Node.js modules can be bypassed by using the `node:` URL scheme prefix or by requesting module subpaths (e.g., `module/subpath`). Ensure that module names are normalized by stripping the `node:` prefix and splitting on `/` to extract the core module name before checking the list.
A denylist checking for dangerous Node.js modules is potentially incomplete. Node.js module resolution allows bypassing exact-match denylists using the 'node:' URL prefix or by resolving subpaths (e.g., 'inspector/promises'). Additionally, ensure 'process' and other host-exposing primitives are blocked.
Filtering Node.js builtin modules by ignoring 'internal/' does not sufficiently block all internal modules. Undocumented underscored modules like `_http_client` and `_http_server` bypass this filter and expose low-level network primitives. To securely restrict builtins, ensure underscored modules are also excluded (e.g., `!s.startsWith('_')`).
Overriding `Symbol.for` with exact string matches (e.g., `=== 'nodejs.util.inspect.custom'`) against Node.js internal cross-realm symbols is an incomplete mitigation. Unhandled `nodejs.` symbols (such as streams or promisify hooks) can bypass the sandbox. Instead, block or isolate the entire `nodejs.` namespace using a prefix match.
Heartbeat owner-downgrade logic computes shouldInspectPendingEvents (or ForceSenderIsOwnerFalse) without considering wake-triggered runs or untrusted pending events. CVE-2026-43566: webhook 'hook:wake' system events were excluded from the inspection set, allowing untrusted webhook payloads to be drained while senderIsOwner remained true. The patched code mus
Detected an incomplete denylist for preventing path traversal. Validating input using string methods like `contains("..")` or `contains("/")` can be bypassed via URL encoding, double encoding, or Unicode normalization because the decoded literal characters are not matched. Instead, use a strict regular expression allowlist (e.g., `^[a-zA-Z0-9._-]+$`) to vali
The regex token `php*` is being used inside a denylist alternation, but in PCRE `*` is a quantifier on the preceding character, so `php*` matches 'ph', 'php', 'phpp', ... and does NOT match '.php4', '.php7', or '.phps'. This is an incomplete list of disallowed inputs (CWE-184): attackers can upload/rename files with PHP-executable extensions like .php4 that
Using `str_replace` or `str_ireplace` with an empty string to sanitize input based on a blocklist is unsafe. Attackers can bypass this by nesting blocklisted words (e.g., 'SELSELECTECT') or using mixed casing. Use a robust sanitization library or parameterized queries instead.
Validation of Git arguments using the regex `/^\s*-u\b/` is insufficient to prevent dangerous option injection. Git allows single-letter options to be grouped (e.g., `-vu`, `-4u`), which bypasses this regex check. Attackers could execute arbitrary code by passing a modified `-u` (upload-pack) option. Use a more robust check that accounts for Git's option gro
A regular expression blocklist explicitly blocks `sudo` but does not include `doas`. Hardcoded command blocklists are inherently incomplete and prone to bypasses (CWE-184). A missing check for `doas` can allow arbitrary command execution as root if the binary is present in the environment (e.g., `doas apk` or `doas sh`). Consider using an allow-list, robust
JDBC parameter denylist contains MySQL-specific entries such as "autoDeserialize" but is missing critical PostgreSQL JDBC driver parameters ("socketFactory", "socketFactoryArg"). An attacker can bypass this denylist by supplying a jdbc:postgresql: URL with socketFactory pointing to an arbitrary Java class (e.g., ClassPathXmlApplicationContext) to achieve una
The denylist for dangerous Python modules is missing critical bypasses like `pkgutil.resolve_name`.
Picklescan's `_unsafe_globals` blocklist is incomplete. Leaving certain attributes in `cProfile`, `profile`, and entirely omitting gadgets like `pkgutil.resolve_name` allows malicious pickle files to bypass malware detection and achieve arbitrary code execution if the analyzed files are later deserialized.
Incomplete denylist for Python pickle deserialization in picklescan. Omitting wildcards for profiling modules can allow malicious RCE payloads to bypass the scanner.
A Windows reserved-device-name denylist enumerates the ASCII variants COM1..COM9 and LPT1..LPT9 but does not include the ISO-8859-1 superscript variants COM¹, COM², COM³, LPT¹, LPT², LPT³ (U+00B9 / U+00B2 / U+00B3). Windows resolves these Unicode names to the same physical COM/LPT devices, and `to_uppercase()` / ASCII case folding does not normalize superscr
