Rule Explorer

Skill instruction executes helper scripts via relative paths from the workspace directory instead of anchoring to the skill root directory.

Invoking system executables (e.g., taskkill, cmd, powershell) in NSIS without specifying an absolute system directory path (such as '$SYSDIR\') enables binary planting and search path hijacking, potentially leading to local privilege escalation.

Invoking the Graphviz 'dot' binary by bare name or discarding the return value of 'find_binary' can lead to untrusted search path execution (CWE-426 / CWE-427). Ensure the resolved absolute path returned by 'find_binary' is used when executing subprocesses.

PythonCVE-2026-78680CWE-426CWE-427

Using 'os.system("clear")' or 'os.system("cls")' invokes a shell to clear the terminal screen, which is vulnerable to PATH hijacking and unnecessary subprocess overhead. Use ANSI escape sequences (e.g., sys.stdout.write('\033[2J\033[H')) instead.

PythonCVE-2026-74899CWE-426CWE-78

Invoking os.system('clear') or os.system('cls') executes a shell process that searches the system PATH, creating potential PATH hijacking and binary planting risks. Use ANSI escape sequences (such as sys.stdout.write('\033[2J\033[H')) instead.

PythonCVE-2026-74896CWE-426CWE-78

Using os.system('clear') or os.system('cls') to clear the terminal relies on external binary resolution via PATH and shell execution, risking PATH hijacking. Use ANSI escape sequences (e.g. sys.stdout.write('\033[2J\033[H')) instead.

PythonCVE-2026-74889CWE-426CWE-78

Using `os.system` to clear the terminal screen ('clear' or 'cls') invokes an external subshell and PATH resolution, which can lead to untrusted execution or environment issues. Use ANSI escape sequences (`sys.stdout.write('\033[2J\033[H')`) instead.

PythonCVE-2026-74872CWE-426CWE-78

Constructing a path for dlopen using an unvalidated user-supplied string can allow an attacker to load arbitrary shared libraries via path traversal.

C++CVE-2026-58302CWE-22CWE-426

Assigning an empty string to an element of `sys.path` (e.g., `sys.path[0] = ""`) instructs Python to include the current working directory (CWD) in its module resolution path. This can lead to local Search Path Hijacking (CWE-426) if the script is executed from an attacker-controlled directory, allowing malicious modules to be imported in place of legitimate

PythonCVE-2026-5271CWE-426CWE-427

Detected an mpv argument list that does not explicitly include '--no-ytdl'. By default, mpv will attempt to execute 'youtube-dl' or 'yt-dlp' to resolve network stream links. In scenarios where user-controlled files or unverified directories are present, this can lead to arbitrary code execution if an attacker supplies a malicious executable matching the down

PythonCVE-2025-62185CWE-426CWE-94

Constructing executable or plugin search paths inside `C:\ProgramData` can lead to privilege escalation. Windows allows unprivileged users to create subdirectories inside `C:\ProgramData` by default. If a privileged process searches for an executable in a non-existent subdirectory of `ProgramData`, a low-privileged attacker can pre-create the directory and p

GoCVE-2025-15558CWE-426

Async writer serializes a mutable object parameter to disk via JSON.stringify inside the write call. If the caller also retains a reference to the same object (for example, by inserting it into a shared in-memory cache), any mutation performed between the call and the deferred write will be persisted, allowing one execution context to poison a shared on-disk

TSCVE-2024-53866GHSA-VM32-9RQF-RH3RCWE-426

Executing a subprocess with a relative path (e.g., 'cp', 'iptables') rather than an absolute path makes the application vulnerable to Untrusted Search Path (CWE-426) attacks. If the application is run from a directory controlled by an attacker, or if the PATH environment variable is manipulated, an attacker can execute arbitrary binaries, potentially leading

PythonCVE-2024-48911CWE-426CWE-427

A wrapper function exposing child_process methods directly passes an unqualified command parameter without apparent path validation. If the executing environment runs in an untrusted directory, this can trigger an Untrusted Search Path vulnerability (CWE-426), where a local executable is hijacked. Ensure that commands are validated (e.g., checking for path t

JSCVE-2021-4435CWE-426