Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Untrusted template code is compiled or evaluated with Function/eval in the host realm instead of a hardened VM realm. Compiling a stored template with new Function() in the worker's own realm, and handing it the host payload object by reference, lets $payload.constructor.constructor resolve to the host Function constructor and execute arbitrary code (sandbox
This sanitizer builds a shallow copy of the host Node.js crypto module and neutralizes the process-wide mutator crypto.setEngine, but returns the copy without also neutralizing crypto.setFips. The read-only/sandbox wrapper used to expose the copy blocks property replacement but not the side effect of a forwarded host call, so untrusted sandbox code can still
A host builtin module is handed to the sandbox behind a read-only proxy without neutralizing dangerous members first. A read-only (write-blocking) proxy still forwards every property read and every method call to the raw host object, so sandbox code reaches host-authority members: subscribing to a process-wide singleton (e.g. https.globalAgent.on('free', ...
Unvalidated dynamic function invocation detected in Electron IPC handler. Renderer processes can invoke arbitrary methods on the target object or traverse prototype properties unless the method name and IPC sender are strictly validated.
This Electron window/view is created with nodeIntegration: true and contextIsolation: false. Any page later loaded into it — remote web content, a renderer-supplied URL passed over IPC, or a destination reachable through links/navigation/window.open — runs with full Node.js privileges (require('child_process'), require('fs'), os, process.env) under the OS ac
A gin Group has REST API handlers registered via `RegisterRoutesTo` without the `authenticate` middleware being applied to that group. When this group is mounted on the metrics/management gin engine (default TCP/9091), it exposes business endpoints (collection CRUD, credential management, search/query) without authentication — even when `common.security.auth
Twig sandbox SecurityPolicy callback implemented as a no-op. Twig calls checkMethodAllowed() before every method call and checkPropertyAllowed() before every property access inside a sandboxed template; an empty implementation lets templates invoke arbitrary methods and read arbitrary properties on any object reachable from the template context (e.g. object.
WebView load files from external storage. Files in external storage can be modified by any application. Loading files from external storage in a WebView can introduce security risks, as it allows web content to access potentially sensitive data stored on the device's external storage. This can lead to unauthorized access to user data, including personal file
JavaCWE-749
