Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Agent tools exposing file operations via static methods lack instance-level context necessary for proper sandboxing (e.g., workspace bounds). This can allow an attacker to exploit agent prompts to perform arbitrary file reads/writes outside intended boundaries. Refactor tools to use instance methods and explicitly enforce workspace access controls.
A shared memory segment is created with overly permissive access rights (e.g., 0777, 0666). This allows local users to read or modify the shared memory segment, potentially leading to information disclosure, denial of service, or code execution. Use strict permissions such as 0600.
Calling `fs::set_permissions` (or `<Path>.set_permissions`) with `Permissions::from_mode(0o0777)` / `from_mode(0o777)` grants world read/write/execute on the target path. When this path is a shared directory used to host IPC sockets, lock files, or other privileged endpoints (e.g. under `/tmp`), any local user can enumerate, replace, or pre-create entries an
Cache::FileCache uses a default directory_umask of 000, creating world-writable cache directories. If deployed in a shared location like /tmp, this enables local cache poisoning and potentially arbitrary code execution via Storable deserialization (CWE-502, CWE-732). Explicitly pass `directory_umask => 077` (or similarly restrictive umask) to the constructor
Using `mergo.Merge` with `mergo.WithOverride` to merge a user-supplied `Container` (typed as the upstream `k8s.io/api/core/v1.Container` or reachable through a CR `Spec.Template.Container`) into an operator-built container lets a low-privileged tenant override arbitrary container fields — image, command, args, securityContext (privileged/runAsUser/capabiliti
Setting explicitly world-writable permissions (e.g., 0o777 or 0o666) on files or directories can result in local privilege escalation or unauthorized modification. If a privileged service writes to a world-writable directory, local attackers can use symlink attacks to overwrite critical system files. Rely on safe default permissions (umask) or restrict write
ClusterRoleBinding (or RoleBinding) grants permissions to the built-in group "system:authenticated" (or "system:unauthenticated"). This binds the referenced role to every authenticated principal in the cluster, effectively making the role's permissions universal. This pattern caused CVE-2025-10725 (opendatahub-operator) by binding a Job/Workload-create role
Enabling the shared holotree feature in Robocorp RCC (via `holotree shared --enable`) configures Python environments with overly permissive access rights. This enables unprivileged local users to edit the environment files, potentially leading to local privilege escalation if the environment is later accessed or executed by a higher-privileged user or system
Explicitly setting the SUID bit on installed binaries grants elevated privileges to any executing user. If the underlying binary can process user-controlled inputs, environment variables, or arguments, this setup trivially enables absolute Local Privilege Escalation (LPE) to the file owner's context (often root). Ensure this configuration is intentional, or
Temporarily assigning a permissive umask (e.g., 022) to force newly created files to be world-readable can leak sensitive information. For example, VPN private keys in network configuration files may become accessible to unprivileged local users (CVE-2022-4968). Additionally, umask() is process-wide and not thread-safe. Instead of toggling umask, explicitly
When `SetSecurityDescriptorDacl` is called with a null `pDacl` parameter and the `bDaclPresent` flag is `TRUE`, all access to the object is allowed. An attacker could set the object to Deny all, which would include even the Administrator user(s). Either call `SetSecurityDescriptorDacl` with bDaclPresent as `FALSE`, or supply a valid non-null `pDacl` paramete
Overly permissive file permission
KotlinCWE-732The application was found setting file permissions to overly permissive values. Consider using the following values if the application user is the only process to access the file: - 0400 - read only access to the file - 0200 - write only access to the file - 0600 - read/write access to the file Example creating a file with read/write permissions for the appl
GoCWE-732The application was found setting directory permissions to overly permissive values. Consider using the following values if the application user is the only process to access files in the directory specified: - 0700 - read/write access to the files in the directory Another common value is `0750` which allows the application user read/write access and group u
GoCWE-732The application was found setting file permissions to overly permissive values. Consider using the following values if the application user is the only process to access the file: - 0400 - read only access to the file - 0200 - write only access to the file - 0600 - read/write access to the file Example creating a file with read/write permissions for the appl
PythonCWE-732Make sure that you set inheritance by hand if you wish it to inherit.
The application was found to permit the `RuntimePermission` of `createClassLoader`, `ReflectPermission` of `suppressAccessChecks`, or both. By granting the `RuntimePermission` of `createClassLoader`, a compromised application could instantiate their own class loaders and load arbitrary classes. By granting the `ReflectPermission` of `suppressAccessChecks` an
JavaCWE-732Overly permissive file permission
ScalaCWE-732The application was found setting file permissions to overly permissive values. Consider using the following values if the application user is the only process to access the file: - `r--` - read only access to the file - `w--` - write only access to the file - `rw-` - read/write access to the file Example setting read/write permissions for only the owner of
JavaCWE-732Overly permissive file permission
ScalaCWE-732The umask function call sets the process's file mode creation mask. umask values determine what permissions a file should be created with and who can read or write to these files. Ensure that umask is given most restrictive possible setting depending on the context, usually 066 or 077, for more information please see: https://en.wikipedia.org/wiki/Umask#Mask
