Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Missing strict validation of extracted filename. Verify that the extracted filename exactly matches the original input name to prevent silently ignoring path components.
Detected a TypeORM query using an OR condition to combine a global property check with a user ID constraint. Using an array in the `where` option or chaining `.orWhere()` creates an OR condition. If the global property was intended to scope the user's data rather than grant global access to that type, this results in broken access control. Verify the logic s
Forwarding request headers directly to a new fetch or Request object without sanitizing sensitive headers (like 'Authorization' or 'Cookie') can cause a credential leak during cross-origin requests or redirects. Ensure you extract and sanitize headers if the destination origin differs from the source.
A loop looking for sensitive dictionary keys (like 'password') redacts them at the top level but fails to traverse nested arrays. With JSON columns and complex objects, nested payloads may bypass the top-level checks and expose sensitive data in logs or API responses. Ensure redaction loops verify if the value is an iterative type (like an array) and branch
A function selectively copies properties from a `RequestInit` object (e.g., `credentials`) but fails to reference the `cache` property. In Service Workers or proxies, dropping explicit cache controls can cause requests that specified `cache: 'no-store'` to fall back to default browser caching, leading to unintentional local leakage of sensitive data. Explici
A debug print statement directly outputting the contents of a file to standard output. If this file contains sensitive data (like cookies), this can lead to information disclosure via logs or console output.
Unrestricted inline remote instantiation in rclone's server allows unauthenticated attackers to execute arbitrary commands by supplying crafted backend connection strings. Validate user-provided backend configuration strings against the active authentication context using 'checkServeRemote()' before calling 'cache.Get()'.
Calculating the width of the last element in a buffer by subtracting its offset from the total buffer size may cause out-of-bounds reads or information disclosure if the buffer includes trailing alignment padding. Verify if the size should be calculated directly based on the element's parsed structure rather than buffer bounds.
A JWT secret is loaded from configuration or environment and used without explicit length or weakness validation. If the variable is unset or overridden with weak values (e.g., an empty string), an attacker can forge valid JWTs to bypass authentication. Verify the length and strength of the secret before initializing the JWT instance.
A cross-origin check compares only `.hostname` or `.host`, ignoring the scheme and/or port. During HTTP redirects, this can cause sensitive credential headers (like cookies and authorization) to be leaked when redirecting to a different scheme (e.g., HTTPS to HTTP) or port on the same host. Use `.origin` to safely compare if two URLs belong to the same origi
Potential timing side channel due to early break or use of non-constant-time comparison functions (memcmp, strcmp, etc.) during authentication. Use constant-time comparison functions and ensure evaluation does not exit early based on matching results.
Converting data (often derived from user input via `.split()`) to `BigInt` without error handling can be dangerous. In JavaScript, `BigInt('invalid')` throws a `SyntaxError` and `BigInt(NaN)` throws a `RangeError`. If these exceptions are unhandled, they may lead to application crashes or Denial of Service (DoS) when processing malicious inputs like malforme
A cross-origin redirect handler clears some authentication headers but fails to clear the explicit per-request `cookies` variable. This can leak sensitive per-request cookies to third-party domains.
A protobuf parser skipped a length-delimited group by passing an unvalidated varint length to a `skip` function. An attacker can craft a payload with a negative length, causing the skip operation to throw an unhandled exception and leading to a Denial of Service (DoS). Validate that the length is non-negative before skipping bytes.
String parsing using `replace` assigning extracted keys to an object without checking for duplicate keys. This may allow parameter smuggling or injection if the parser receives duplicate keys (e.g., in HTTP headers). Validate that the key does not already exist before assignment.
Validating a URL, URI, or Schema using `strings.Contains` is insecure. Attackers can bypass this validation by embedding the expected substring inside a harmless part of the URL, such as a query parameter or fragment (e.g., `http://attacker.com/?q=expected_substring`). Evaluate strict equality (`==`), prefix matching, or parse the URL and validate specific c
A non-constant-time shift-and-add modular multiplication routine was detected. The loop `while $EXP > 0` and the branch `if $EXP & 1 == 1` make the execution time proportional to the bit-length and Hamming weight of the multiplier. When operating on cryptographic secrets, this timing side-channel can leak the secret multiplier. Replace this with a branchless
$LOGGER.$FATAL(...) inside a goroutine calls os.Exit(1) after logging, which immediately terminates the entire process — even when the goroutine contains a defer/recover handler. This turns any transient error (e.g., an unreachable callback URI) into a process-level crash that cannot be caught by the caller. Replace with a non-fatal method such as Errorf or
JSON.parse() output is merged directly into an options object via Object.assign() without filtering security-sensitive keys. An attacker who controls the JSON input (e.g. via a URL query parameter, deep link, CLI argument, or crafted shortcut) can inject arbitrary keys that downstream code may use in privileged operations—such as spawning a process with an a
A Redis `pmessage` event listener processes messages without verifying the matched pattern. When using a shared Redis client for publish/subscribe, failing to check the pattern against the locally expected value can result in severe cross-tenant information leaks, where one user receives pub/sub messages intended for another. Ensure the pattern parameter is
Apache Polaris IcebergCatalog location-change validation gate compares USER_SPECIFIED_WRITE_DATA_LOCATION_KEY but omits USER_SPECIFIED_WRITE_METADATA_LOCATION_KEY. A TableMetadata update that only changes write.metadata.path will pass through this gate without running validateLocationsForTableLike, validateNoLocationOverlap, or validateMetadataFileInTableDir
Extracting a dictionary value via `get()` and relying on its truthiness before applying validation can lead to bypasses. Explicit falsy values (e.g., `""` or `null`) sent by a user will evaluate to False, short-circuiting the negative validation block (like `if not is_valid(...)`). The falsy value then sidesteps validation but still remains part of the expli
Detected a custom regex-based string interpolation loop directly substituting dictionary values. If this template is used to construct URLs, it is vulnerable to Path Traversal or SSRF, as the values are neither URL-encoded nor validated against path delimiters. Ensure URL construction uses verified inputs (e.g., blocking `../`, `/`) or use `URL` objects and
Validation of URIs that only checks for the absence of a fragment is insufficient. This allows dangerous schemes (e.g., `javascript:`) and exposes the application to SSRF, Open Redirect, or XSS vulnerabilities. Validate the scheme, host, and port to ensure the URI meets strict security boundaries.
