Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Including 'getattr' or 'setattr' in a whitelist of safe builtins or allowed functions for sandboxed Python execution allows callers to bypass AST-level restrictions and access dangerous attributes or class hierarchies.
Reading `non_interactive_mode` from caller-supplied arguments or kwargs allows prompts and untrusted callers to bypass human-in-the-loop confirmation gates for sensitive tool execution. Drive non-interactive mode through trusted environment variables or host configuration instead.
SpEL compiled expression bytecode is evaluated without verifying whether the EvaluationContext supports compilation, which may bypass SimpleEvaluationContext security constraints.
A Jackson2ObjectMapperBuilderCustomizer bean is conditionally dependent on the existence of an ObjectMapper bean. Because customizers are used to build the ObjectMapper, the ObjectMapper bean does not exist yet when this condition is evaluated. This causes the customizer to be silently skipped, potentially disabling security integrations like XSS filters. Re
This code processes standard AST regular arguments (`.args.args`) but does not handle positional-only arguments (`.posonlyargs`), which were introduced in Python 3.8. Omitting this validation can lead to sandbox bypasses, unnoticed arguments, or faulty code transformations. Ensure `.posonlyargs` are also checked.
Deleting or stripping Content-Security-Policy (CSP) headers in Electron webRequest hooks removes browser security protections against cross-site scripting (XSS) and unauthorized resource loading.
Missing runtime sandbox security check before executing template routines. This allows a sandbox bypass if the sandbox state changes between renders and cached or shared template instances are reused.
Dynamic array key compilation misses a fallback to cast expressions as StringCastUnary. This allows objects to be used as array keys, which coerce to string bypassing the Twig sandbox `ensureToStringAllowed()` security policy check.
A call to a Twig `CoreExtension` array or arrow checking method is missing the explicit `$isSandboxed` parameter or providing an Environment directly instead of resolving the sandbox state. This allows arbitrary PHP functions to bypass the sandbox check, leading to potential Remote Code Execution. Explicitly resolve the sandbox state using `twig_resolve_is_s
A Groovy sandbox `onMethodCall` method lacks a preemptive check to block the `execute` (or `invokeMethod`) method. Because `ProcessGroovyMethods.execute()` is a Groovy extension method that spawns an OS process during invocation, filtering the target or return value is evaluated too late. Ensure `onMethodCall` explicitly evaluates the method name and blocks
A denylist checking for dangerous Node.js modules is potentially incomplete. Node.js module resolution allows bypassing exact-match denylists using the 'node:' URL prefix or by resolving subpaths (e.g., 'inspector/promises'). Additionally, ensure 'process' and other host-exposing primitives are blocked.
Filtering Node.js builtin modules without excluding undocumented underscored modules (e.g., `_http_client`, `_http_server`) can allow sandbox bypasses. Underscored modules expose underlying network or system primitives directly and often circumvent restrictions placed on public modules. Ensure that elements starting with `_` are also filtered out.
AST builders enforcing a sandbox environment fail to set the 'sandboxed' attribute on allowed child nodes. This allows sandbox bypasses via pre-loaded templates, as the compiler relies on this attribute to inject runtime security checks.
Property descriptor value is identified as the Function constructor by comparing `.name === 'Function'`. This check misses AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction — all of which have different .name strings — allowing those constructors to cross a sandbox/proxy boundary unchecked. Replace with identity comparison against all cached dange
Using `assert` for string validation before usage is vulnerable to a bypass because Python strips assert statements from bytecode when executed with optimizations (`-O`). Attackers can supply inputs that bypass string-prefix boundaries, potentially leading to arbitrary code execution, unintended module loading, or path traversal. Replace the `assert` stateme
A globals mapping is being constructed with '__builtins__' aliased to the unrestricted real __builtins__. When this mapping is passed to exec()/eval() for untrusted code, it provides NO sandboxing: the executed code can call exec/eval/compile/__import__/open directly, and can also escape via frame-traversal (e.__traceback__.tb_frame.f_back.f_builtins["exec"]
A @staticmethod in this class performs a destructive filesystem operation (os.remove, os.unlink, shutil.move, shutil.rmtree, or os.rename) but cannot invoke any instance-level access-control method because it has no 'self' reference. Any instance-level authorization policy—such as a workspace read/write access check—is silently bypassed. Convert the method t
LuaRuntime is configured with attribute access control (attribute_filter or attribute_handlers) but register_builtins=False is not set. Python builtins accessible as python.builtins.* inside Lua — including getattr, setattr, eval, and exec — bypass the attribute filter entirely by invoking CPython natively, skipping Lupa's proxy metamethods. This allows sand
The EndpointSecurity event array monitors file creation or modification (e.g., AUTH_CREATE or AUTH_COPYFILE) but lacks subscriptions for ES_EVENT_TYPE_AUTH_EXCHANGEDATA or ES_EVENT_TYPE_AUTH_CLONE. This pattern is associated with an incomplete file monitoring scope, allowing attackers to bypass the authorization boundary via exchangedata or clonefile system
This conditional whitelists Docker network values that start with `container:` as an accepted mode and short-circuits network setup or validation. The `container:<id>` form is a Docker namespace-join directive: it attaches the new container to an existing container's network namespace, exposing services bound to that container's loopback and bypassing sandbo
Unconditionally removing an archive file after an extraction failure can bypass scanning of the original archive file. If extraction fails, the archive should be retained so it can be analyzed as a raw file. Ensure that files are only deleted if extraction succeeds, for example by checking 'if err == nil' before deletion.
Returning `CTX_ACT_OK` at the end of `handle_ipv4` or `handle_ipv6` without handling host delivery allows packets from WireGuard or similar network tunnels to bypass host ingress network policies. Ensure that host-bound packets are correctly redirected (e.g. using `ipv4_host_delivery` or `ipv6_host_delivery`) rather than being permitted by default.
Native function call result is filtered only through getGlobalProp() and returned via done(...) without passing through sanitizeArray(). getGlobalProp() only inspects the top-level reference; arrays returned by native functions (e.g. Object.values, Array.at, Array.slice) can still contain raw global constructors such as Function, enabling sandbox escape (CVE
Calling `.hasOwnProperty()` as an instance method in a function-property mutation guard is unsafe in sandbox or access-control code. When the guarded object is itself a prototype (e.g., `Map.prototype`), its built-in methods ARE own properties. As a result, `!obj.hasOwnProperty(prop)` evaluates to `false` and the guard silently permits the overwrite. This al
