Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Directly accessing 'StringLike' or 'StringEquals' on an AWS IAM Condition object ignores set-qualified operators (e.g., 'ForAnyValue:StringLike') and modifier suffixes (e.g., 'StringLikeIfExists'). Iterate over condition entries and normalize the operator base name instead.
DOMPurify is configured with FORBID_TAGS but does not forbid 'iframe' tags or the 'srcdoc' attribute. DOMPurify does not parse or sanitize the content of the 'srcdoc' attribute, allowing arbitrary script execution via embedded iframe elements. Include 'iframe' in FORBID_TAGS and 'srcdoc' in FORBID_ATTR.
Checking for directory traversal sequences using `.find("..")` or `.find(b"..")` and inspecting the byte/character after `pos` only validates the first occurrence. If `..` appears earlier as part of a safe segment (e.g. `a..b/../`), subsequent traversal components will bypass validation. Iterate over path components split by separators or check all segments
Trust or verification function uses a denylist to reject untrusted paths and defaults to returning True. This fail-open approach allows files in unexpected or root directories to bypass security checks. Use an allowlist instead.
Incomplete SQL LIKE wildcard escaping detected. Escaping `%` and `_` without escaping the backslash `\` character allows attackers to supply backslashes to bypass escaping and perform SQL LIKE pattern injection.
Returning early when traversing nested dictionary keys within a loop over multiple key paths aborts sanitization of subsequent keys. Use break/continue instead of returning immediately.
Performing regex validation on a URL variable without prior stripping of control characters or whitespace allows attackers to bypass link filtering using obfuscated schemes (e.g., 'java\tscript:').
The template filter regex attempts to block dangerous PHP keywords or functions via a blacklist, but omits 'exec'. Relying on incomplete blacklists allows attackers to execute arbitrary system commands via omitted execution functions.
Returning early inside a nested key-path traversal loop aborts processing of remaining items in the outer collection, potentially bypassing sanitization.
Sanitization regex matching dangerous HTML schemes or directives (such as 'javascript', 'data', 'refresh', or 'url') is case-sensitive because it lacks the 'i' flag. Attackers can bypass this filter using uppercase or mixed-case payloads.
Shell command splitting regex omits the lone '&' background operator, allowing chained background commands to bypass security policy gates.
URL validation only blacklists the 'file:' protocol via startswith(). This does not protect against other dangerous schemes such as 'javascript:', 'data:', or SSRF vectors. Use an explicit scheme allowlist (e.g., http/https) and parse URLs using urllib.parse.urlsplit or urlparse.
The `profile` module blocklist is incomplete. It fails to block the module-level `profile.run` and `profile.runctx` functions, allowing attackers to achieve arbitrary code execution via exec() when unpickled.
Naive regex replacement for 'expression(' or 'javascript:' in CSS values is vulnerable to sanitization bypass via CSS Unicode escapes or inline comments. Normalize escapes and comments or reject dangerous inputs entirely.
Detected an incomplete regex blocklist for dangerous SQL features. Regexes such as `\\battach\\s+database\\b` or `\\bpg_read_server_files?\\b` are known to miss alternative syntax or related functions (like `pg_read_file` or `ATTACH` without `DATABASE`), allowing sandbox escapes or arbitrary file reads. Use comprehensive regexes that cover all optional claus
A denylist checking for dangerous Node.js modules is potentially incomplete. Node.js module resolution allows bypassing exact-match denylists using the 'node:' URL prefix or by resolving subpaths (e.g., 'inspector/promises'). Additionally, ensure 'process' and other host-exposing primitives are blocked.
AST builders enforcing a sandbox environment fail to set the 'sandboxed' attribute on allowed child nodes. This allows sandbox bypasses via pre-loaded templates, as the compiler relies on this attribute to inject runtime security checks.
Heartbeat owner-downgrade logic computes shouldInspectPendingEvents (or ForceSenderIsOwnerFalse) without considering wake-triggered runs or untrusted pending events. CVE-2026-43566: webhook 'hook:wake' system events were excluded from the inspection set, allowing untrusted webhook payloads to be drained while senderIsOwner remained true. The patched code mus
Detected an incomplete denylist for preventing path traversal. Validating input using string methods like `contains("..")` or `contains("/")` can be bypassed via URL encoding, double encoding, or Unicode normalization because the decoded literal characters are not matched. Instead, use a strict regular expression allowlist (e.g., `^[a-zA-Z0-9._-]+$`) to vali
The regex token `php*` is being used inside a denylist alternation, but in PCRE `*` is a quantifier on the preceding character, so `php*` matches 'ph', 'php', 'phpp', ... and does NOT match '.php4', '.php7', or '.phps'. This is an incomplete list of disallowed inputs (CWE-184): attackers can upload/rename files with PHP-executable extensions like .php4 that
Using `str_replace` or `str_ireplace` with an empty string to sanitize input based on a blocklist is unsafe. Attackers can bypass this by nesting blocklisted words (e.g., 'SELSELECTECT') or using mixed casing. Use a robust sanitization library or parameterized queries instead.
Validation of Git arguments using the regex `/^\s*-u\b/` is insufficient to prevent dangerous option injection. Git allows single-letter options to be grouped (e.g., `-vu`, `-4u`), which bypasses this regex check. Attackers could execute arbitrary code by passing a modified `-u` (upload-pack) option. Use a more robust check that accounts for Git's option gro
Detected an incomplete denylist of unsafe Python modules. A denylist containing dangerous modules like 'subprocess' but missing obscure internal execution vectors like '_posixsubprocess', 'site', or 'atexit' can be bypassed by malicious execution payloads (e.g., CVE-2026-14534 via pickling). Ensure that all underlying execution and configuration modules are
A regular expression blocklist explicitly blocks `sudo` but does not include `doas`. Hardcoded command blocklists are inherently incomplete and prone to bypasses (CWE-184). A missing check for `doas` can allow arbitrary command execution as root if the binary is present in the environment (e.g., `doas apk` or `doas sh`). Consider using an allow-list, robust
