Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A client-controlled file name flows into a filesystem path built with filepath.Join / string concatenation and reaches a filesystem operation without a containment check. filepath.Join only lexically cleans "." and ".." elements, so a name containing "../" resolves outside the intended base directory, enabling arbitrary file read/write/delete; interpolating
A value classified as a local file reaches a filesystem read without canonicalization and containment validation. A stored, user-influenced media path (recorded from a request and later prefixed with the upload directory) can contain `..` segments or be absolute, so the worker reads any file the process can access and the provider then uploads those bytes to
The Get action of a credential sub-resource endpoint (key/token/secret/credential/password path) is authorized with a read-only view entitlement instead of the edit-level entitlement used by the mutating verbs on the same resource. Handlers on such sub-resources return the secret material itself (e.g. the S3 access_key and secret_key of a storage bucket key)
Path traversal (CWE-22): a file path is built with os.path.join($BASE, $P) and passed to open() without proving the resolved target stays inside $BASE. os.path.join silently discards $BASE when $P is absolute, and os.path.normpath only collapses "../" lexically, so an attacker-controlled $P can read any file readable by the process. Reject absolute arguments
Filesystem operation consumes a URL-decoded path (rawurldecode/urldecode in a path argument). Percent-encoded traversal (e.g. '%2e%2e%2f') contains no literal dot segments, so any containment check performed on the still-encoded value passes and the decode at the sink resolves the path outside the intended directory (check-before-decode, CWE-180/CWE-179). De
A filename read from object metadata (e.g. a notebook cell output's metadata.filename, archive entry metadata, or any deserialized document) flows into os.path.join() without being reduced to a bare filename. Components such as "../../evil.png" or "/tmp/evil.png" escape the intended output directory (an absolute component makes os.path.join() discard the bas
A Unix permission mode is derived from archive entry attributes with a mask ($MASK) that keeps the setuid (0o4000), setgid (0o2000) and sticky (0o1000) bits. Those bits come verbatim from attacker-controlled archive metadata; when the resulting mode is applied to extracted files (chmod/chmodSync, e.g. behind a keepOriginalPermission option), a crafted archiv
This access-token issuance request scopes the credential to a wildcard stream prefix (`streams: { prefix: ... }`) with `auto_prefix_streams: true`, so the minted token is valid for every stream under the environment prefix instead of only the resource being authorized. If this token is handed to a client (e.g. returned in a response header), a caller authori
A URL pathname is passed to a path join without backslash normalization. POSIX joining treats '\' as an ordinary filename character, so a client-controlled pathname such as 'x:\..\..\secret' survives the join as a single segment that still resolves inside the root and passes fs.allow / isFileLoadingAllowed checks, while a later filesystem read on Windows int
Assigning a literal array to Vite's `server.fs.deny` REPLACES Vite's built-in default deny list ('.env', '.env.*', '*.{crt,pem,key,p12,pfx,cer,der}', '.npmrc', '.yarnrc.yml', '**/.git/**'); Vite only applies those defaults when `fs.deny` is unset. The dev/transform server will therefore serve .env secrets, TLS private keys/certificates, .npmrc/.yarnrc.yml re
PocketBase collection "$NAME" declares API rule "$RULE" as the empty string "". In PocketBase, an empty-string rule evaluates as "always allow", which makes every record in this collection publicly readable, creatable, updatable and deletable by unauthenticated callers via /api/collections/<name>/records (broken access control / missing authentication). Repl
A caller-controlled model-artifact path reaches an external classifier/JVM command line as the value of a read/write option ("-l" read target, "-d" write target) without being bounded to the containment data roots. An attacker who controls the model path can make the external process write an arbitrary file via "-d" (e.g. ../../../etc/cron.d/evil or ~/.ssh/a
$PATH is created or chmod-ed with mode $MODE, which grants write access to group/other users. The mode argument of file/directory creation calls is only narrowed by the ambient process umask, and os.Chmod is not filtered by umask at all, so the artifact can end up world-writable (deterministically for chmod, and whenever the process runs with a permissive um
A path value read from file content flows into a recursive, forceful filesystem removal. If that file ships inside attacker-influenced content (an installed package/plugin/skill, an upload, or an external sync), the attacker chooses which directory is destroyed (CWE-73, arbitrary recursive deletion). Only delete paths derived from validated application state
A filesystem path is built with a raw `$BASE / $NAME` join and then mutated on disk with `mkdir(parents=True, ...)` (typically also written via write_text/write_bytes) without resolving the result and verifying it stays inside `$BASE`. pathlib's `/` operator preserves an absolute `$NAME`, discarding `$BASE` entirely, and keeps `..` segments that the OS resol
Private key material ($DATA) is written to disk without owner-only file permissions. fs write APIs default to mode 0o666 (& ~umask), typically leaving the unencrypted private key world-readable: any other local user can copy the key and impersonate the TLS endpoint it authenticates, or - if the cached certificate is CA-capable - mint trusted certificates for
An externally influenced, path-shaped component (e.g. profile/config fields such as folder, name, path, directory, file, filename, filepath, dest, destination or outDir) is appended onto a separate base directory with join() or resolve() without a containment check. node:path join() and resolve() normalize '..' segments but never clamp the result to the base
A directory that holds a Unix-domain IPC socket (or natively executed binaries) is derived from the shared system temp directory and created with a plain recursive `mkdirSync` that sets no owner-only mode and is not verified for ownership, or a security-critical artifact path (socket, plugin worker, native/executable cache) is rooted directly at the shared t
Unix file-mode bits are derived from attacker-controlled archive/external-attribute metadata using a mask wider than 0o777, so the setuid (0o4000), setgid (0o2000) and sticky (0o1000) bits authored inside the archive are preserved. When the value is later applied to the filesystem (e.g. fs.chmod/chmodSync during keepOriginalPermission-style extraction), a cr
Exec-approval Allow rules are accepted (validator returns null) without requiring a concrete executable token. A remote caller of system.execApprovals.set can persist an Allow rule whose first token contains a wildcard (e.g. "*.*", "*.exe", "c*"): the glob is expanded over the entire command line, so one rule matches nearly every command and later system.run
Parsing attacker-influenced SVG with usvg's default Options leaves the library's default image_href_resolver active, so <image href>/<xlink:href> string values are resolved as local filesystem paths and every referenced file is read in full during parsing/rasterization. An attacker who can make this service process a crafted image/svg+xml resource (e.g. via
The value $ARG reaches a git command line before the `--` end-of-options separator without validation. Git parses any value whose first character is `-` as an option rather than a revision, so an attacker-controlled ref (e.g. `--output=/etc/cron.d/x`) can make git create, overwrite, or truncate an arbitrary file outside the intended workspace directory. Vali
Permission bits are applied to this destination before ownership is finalized: if the later chown fails (EPERM for an unprivileged or capability-restricted invoker), the file/directory is left carrying the requested setuid/setgid bits while still owned by the invoking account, leaving a leftover set-id file that a later privileged chown turns into a genuine
Incomplete sandbox builtin denylist: this Node-builtin policy table enumerates the known process-wide host-state builtins (module, worker_threads, cluster, inspector, process, ...) but does not deny `os` and `dns`. Every enforcement layer keyed off this table (the `'*'` wildcard expansion and the explicit-allowlist / makeBuiltins rejection) still hands sandb
