Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Envelope size is concatenated directly into SMTP command arguments without numeric coercion, which may allow SMTP command injection via CRLF sequences.
Database names must be validated with _mongoc_validate_db_name before assembling commands or formatting namespaces to prevent namespace injection.
Git config values are serialized without quoting comment characters ('#', ';') or edge whitespace, which can lead to config directive injection.
Parameter key-value pairs are concatenated using structural delimiters ('=' and '&') without escaping via encodeURIComponent or unambiguous serialization framing. This permits delimiter injection that can lead to cache-key collisions or parameter spoofing.
A CSS scrubber attempts to remove `@import` rules using a regular expression that requires at least one whitespace character (`\s+`). This allows an attacker to bypass the security filter by omitting whitespace completely, such as `@import"url"`. Additionally, ensure CSS character escapes (e.g., `@\69 mport`) are decoded before regex filtering. Fix the regex
Interpolating unencoded variables (such as a sender email address) directly into a URL path can lead to URL path injection. An attacker can include characters like `?`, `#`, or `/` to manipulate the request URL and execute unintended API operations. Ensure you encode path segments using `URI.encode/2` before interpolation.
Manually escaping strings for JSON context using regex replacements (e.g., replacing newlines and quotes) is error-prone. Inadequate escaping allows attackers to break out of string literals and inject arbitrary JSON. Use native JSON serialization like `JSON.stringify(value).slice(1, -1)` which handles all necessary control characters and Unicode escapes saf
DNS record name or type is processed without control character sanitization or record type allowlist validation, potentially leading to DNS zone file injection.
The CSS selector scope check uses `startsWith(namespace)` without verifying trailing delimiters (such as spaces or child combinators). Selectors with sibling combinators (e.g., `#namespace~*`) can bypass scope prepending, leading to CSS injection or style pollution.
Dynamically constructing Envoy scripts (like Lua filters) via format strings or buffers allows code injection. An attacker can break out of string literals or inject arbitrary commands if untrusted input is interpolated into the script payload. Instead, pass configuration inputs cleanly through Envoy's FilterContext and read them inside static scripts using
Dynamically constructing a JDBC database URL and returning it without centralized validation can lead to JDBC Injection. Attackers could manipulate connection parameters or use dangerous protocols (e.g., 'zip:' or 'jndi:') to achieve Remote Code Execution. Ensure the URL is validated against a strict security policy before being returned or established.
Server-Sent Events (SSE) data escaping only replaces LF ('\n') with the data field prefix, ignoring carriage return ('\r' / '\r\n') line breaks. This can lead to SSE frame corruption or injection if user input contains carriage return characters.
The GitHub Action workflow runs the `anthropics/claude-code-action` with powerful, unconstrained MCP tools like `mcp__github__submit_pending_pull_request_review`. If the workflow processes pull requests or issues from untrusted authors, this exposes the system to prompt injection. An attacker could hijack the AI reviewer to abuse these tools or exfiltrate th
User-supplied environment variable keys are persisted (e.g. to a .env file) after being normalized only with strings.TrimSpace, without being validated against a strict POSIX env-name pattern such as `^[A-Za-z_][A-Za-z0-9_]*$`. A key containing a newline or `=` allows arbitrary additional `KEY=VALUE` lines to be injected into the destination file, which comb
record_metric assembles a StatsD wire-protocol datagram by concatenating $metric and $suffix into "<prefix><metric>:<value><suffix>\n" without validating them against the StatsD protocol delimiters newline (\n), colon (:), and pipe (|). Untrusted metric names containing these characters can inject additional StatsD metrics into the same UDP packet, poisoning
Insecure manual JSON string escaping: using .replace(/(?<!\\)"/g, '\\"') to sanitize user-controlled values for JSON string interpolation is bypassable. The negative lookbehind treats a user-supplied backslash before a double-quote as an escape prefix, so that quote is left unescaped in the output. Because the backslash itself is never encoded to '\\', the J
Incomplete manual escaping of strings for JSON using regex replacement can lead to JSON injection or parsing errors. Use JSON.stringify instead.
String interpolation using unsanitized dictionary values. When the result is used in an HTTP request URL, it may lead to Path Traversal or Server-Side Request Forgery vulnerabilities. Ensure input structure is validated (e.g., characters like ?, #, /, and .. are restricted).
Manual string replacement for escaping quotes and newlines in JSON payloads is error-prone and can lead to JSON injection or malformed payloads. Use standard JSON serialization (such as JSON.stringify) instead.
A topic/manifest entry obtained from a remote source is appended to the enabled list without verifying that its `name` field is free of control characters. Newlines or other control characters in `name` can break out of the intended APT sources.list line and inject arbitrary `deb`/`deb-src` entries into /etc/apt/sources.list.d (CVE-2026-39958). Validate the
Tokenizing user input with `parse_special` enabled (such as `params.interactive_specials`) allows user input to parse into control tokens, enabling prompt injection and control hijacking.
The deprecated GitHub Actions workflow commands `set-env` and `add-path` are handled without checking the `ACTIONS_ALLOW_UNSECURE_COMMANDS` opt-in environment variable. Real GitHub Actions disabled these commands in October 2020 (CVE-2020-15228) because untrusted data echoed to a step's stdout can inject them and arbitrarily mutate environment variables or P
Using manual `.replace()` calls to escape double quotes for JSON string substitution is vulnerable to JSON injection. A regex like `/(?<!\\)"/g` or `/"/g` without properly handling backslashes allows an attacker to inject a backslash and bypass the quote escape (e.g., `\"`). When parsed, the injected backslash escapes itself, leaving the quote to prematurely
jsPDF is vulnerable to arbitrary PDF object injection. The `createAnnotation` method incorrectly concatenates user input into the `/DS` (default style) PDF string property without escaping. An attacker can break out of the parentheses to inject malicious PDF metadata, including `/AA` for JavaScript execution.
