Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Untrusted template code is compiled or evaluated with Function/eval in the host realm instead of a hardened VM realm. Compiling a stored template with new Function() in the worker's own realm, and handing it the host payload object by reference, lets $payload.constructor.constructor resolve to the host Function constructor and execute arbitrary code (sandbox
Dynamic attribute resolution with getattr()/__getattribute__() on a non-literal name inside the workflow expression engine, with no "_"-prefix (dunder/private-name) guard on that name in the enclosing function. The attribute name is attacker-controlled expression input, so a crafted dot path such as item.__class__.__base__.__subclasses__[...].__globals__ esc
This sandbox builtin denylist blocks Node.js host-escape builtins (module/worker_threads/cluster/vm/repl/inspector/process/...) but omits 'child_process'. A denylist shaped like this typically drives both the '*' wildcard expansion and the explicit builtin allowlist of a sandbox require() loader, so the real host child_process module is admitted and handed t
vm2 host→sandbox delivery chokepoint ($COERCE in lib/bridge.js) wraps host values into sandbox proxies without refusing the host realm's global object. When sandbox code calls an embedder-exposed sloppy-mode (non-strict) host function with a nullish receiver, V8's OrdinaryCallBindThis substitutes the host global for `this`; this chokepoint then wraps and del
Assimilating Promise static method $METHOD is overridden with a wrapper that forwards unconditionally to the captured native implementation and has no async-availability guard. When the host enforces a no-async policy on the sandbox (e.g. allowAsync:false), these statics still resolve attacker-supplied thenables: the engine enqueues a PromiseResolveThenableJ
Incomplete mitigation of the host-realm `Object.prototype.__proto__` accessor: only the raw setter is handed to the dangerous-host-function deny registry ($DENY($DESC.set)); the raw getter is never denied delivery to sandbox code. Attacker-controlled sandbox code can therefore extract the raw host proto-reader (e.g. via a host Function.prototype.call/apply i
NodeVM is configured with `require.external` enabled but without a `require.root` boundary, and external code runs in the host realm (the default `require.context` is 'host'). Sandboxed code can then require() any attacker-named path, including its own script file, and the module is loaded through the real host require() and executes in the host Node.js proc
vm2's NodeVM builtin allowlist is gated by the hard DANGEROUS_BUILTINS denylist in lib/builtin.js, and that Set omits the Node.js 'test' builtin family ('test', 'node:test', 'node:node:test', 'test/reporters', 'node:test/reporters'). On vm2 3.9.6-3.11.6 an embedder that lists the family in require.builtin gets the real host test runner registered into the sa
A vm2 NodeVM sandbox is created with `require.external` enabled but without a `require.root` boundary (and without `require.context: 'sandbox'`). Sandboxed code can then `require('vm2')` (or require any host path), receive the real host VM/NodeVM classes through the host `require`, construct a nested NodeVM with attacker-chosen options (e.g. `require: { buil
Promise.prototype.then/catch/finally is overridden by plain assignment. When the target already owns that data property (i.e. the engine intrinsic is being patched, which is exactly what sandbox/hardening wrappers do), V8's SetPrototypeProperties fast path updates the property WITHOUT invalidating the PromiseThenLookupChain protector. Native consumers that r
Sandbox-global bootstrap hardens platform intrinsics by reflectively removing well-known globals (Reflect.deleteProperty or a local alias of it such as localReflectDeleteProperty, or the delete operator) — timers, microtasks, eval/Function, WebAssembly.instantiateStreaming, process/require, console, SharedArrayBuffer/Atomics, ... — but does not remove Finali
A host builtin module is handed to sandbox code through the read-only containment wrapper without member-level sanitization. A read-only proxy blocks property assignment but forwards every method call to the host realm with full host-process authority, so privileged module members stay reachable from sandbox code: tls.setDefaultCACertificates() swaps the hos
A host builtin module is handed to the sandbox behind a read-only proxy without neutralizing dangerous members first. A read-only (write-blocking) proxy still forwards every property read and every method call to the raw host object, so sandbox code reaches host-authority members: subscribing to a process-wide singleton (e.g. https.globalAgent.on('free', ...
A host builtin module is handed to sandboxed code behind a read-only proxy without neutralizing its dangerous callable members first. A read-only proxy blocks property assignment, but it forwards every property read and every function call to the real host object with full host-process authority. A member such as crypto.setEngine(path) therefore reaches Open
A host builtin module is handed to sandbox code through the read-only proxy wrap without first passing it through a member-sanitizing call. The read-only proxy only blocks property assignment; its get/apply traps forward every method call to the real host object with full host authority. Any host-authority callable on that module (e.g. a constructor/option t
Recursive sanitizer cycle-memo stores a presence bit (`set(e, true)`) and resolves a revisit by returning the RAW input (`if (get(e)) return e;`). This is only sound when every branch seals the carrier in place. If any path in the same visited-map traversal REBUILDS a carrier into a fresh sanitized object (snapshot-and-rebuild sanitizer), a second reference
Directly delegating ClosureMetaMethod calls or properties to super.on* in a Groovy sandbox interceptor bypasses sandbox verification, allowing unauthorized dynamic method execution.
Groovy sandbox AST visitor checks for disallowed 'extensions' annotation members to prevent sandbox bypass, but fails to validate the 'builderStrategy' member of @Builder annotations. Groovy's BuilderASTTransformation instantiates the builderStrategy class at compile time prior to checking if it implements BuilderStrategy, allowing code execution outside the
A Groovy sandbox AST transformation blocklist blocks ASTTest but omits GroovyASTTransformationClass. Attackers can use @GroovyASTTransformationClass to invoke arbitrary AST transformations during script compilation, bypassing sandbox restrictions to execute arbitrary code.
Falling back to `invokeMethod` in a Groovy interceptor without verifying whether the receiver is `NullObject` or `null` allows calls on null receivers to bypass sandbox restrictions via dynamic category dispatch or Groovy runtime fallback.
Device-code grant redemption (grant_type=urn:ietf:params:oauth:grant-type:device_code) validates the redeeming user only with UserModel.isEnabled() and never consults brute-force lockout state. Temporary lockout is tracked separately by BruteForceProtector/attack-detection state and does not clear the enabled flag, so an approved, non-expired, single-use dev
Overriding the configured reCAPTCHA version with a version detected from the client payload allows attackers to downgrade validation from v3 to v2, bypassing score threshold and expected action checks.
Router TLS conflict resolution falls back to default TLS configuration without failing closed, potentially allowing security policy downgrade or mTLS bypass.
Including 'getattr' or 'setattr' in a whitelist of safe builtins or allowed functions for sandboxed Python execution allows callers to bypass AST-level restrictions and access dangerous attributes or class hierarchies.
