Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Configuration value is passed directly to an OS command execution function without proper escaping or validation. An attacker with configuration modification privileges could inject arbitrary commands.
Constructing command strings using string formatting functions and executing them with system() or popen() can lead to command injection. Use exec* functions with distinct arguments instead of invoking a shell.
Dynamic command string constructed via template literals or string concatenation passed to `exec`, `execSync`, or promisified `exec`. This can lead to OS command injection (CWE-78). Use `execFile` or `execFileSync` with argument arrays instead.
Invoking the native 'zip' command without a '--' delimiter before dynamic file sources can lead to argument injection and command execution via crafted file names or options such as '-T' and '-TT'.
Missing buffer capacity validation when decoding byte array data or setting length can lead to out-of-bounds writes.
Unchecked response size copied into destination buffer in stream read implementation. Ensure the response length is validated to not exceed the requested buffer capacity (cb) before calling CopyMemory or memcpy.
Using 'os.system("clear")' or 'os.system("cls")' invokes a shell to clear the terminal screen, which is vulnerable to PATH hijacking and unnecessary subprocess overhead. Use ANSI escape sequences (e.g., sys.stdout.write('\033[2J\033[H')) instead.
Invoking os.system('clear') or os.system('cls') executes a shell process that searches the system PATH, creating potential PATH hijacking and binary planting risks. Use ANSI escape sequences (such as sys.stdout.write('\033[2J\033[H')) instead.
Using os.system('clear') or os.system('cls') to clear the terminal relies on external binary resolution via PATH and shell execution, risking PATH hijacking. Use ANSI escape sequences (e.g. sys.stdout.write('\033[2J\033[H')) instead.
Using `os.system` to clear the terminal screen ('clear' or 'cls') invokes an external subshell and PATH resolution, which can lead to untrusted execution or environment issues. Use ANSI escape sequences (`sys.stdout.write('\033[2J\033[H')`) instead.
Allowed binary command configuration does not validate or reject dangerous command-line options, allowing potential argument injection / arbitrary file write.
Unquoted user command argument `<args>` used in shell execution (`system()` or `exe`). This can lead to arbitrary shell command execution when user input contains shell metacharacters. Use `<q-args>` and pass arguments as a list to `system()` or `term_start()`.
Unsanitized variables interpolated into command string template literals or shell options can lead to OS command injection. Avoid string interpolation when executing commands via SSH exec or shell spawn, and pass structured argument arrays instead.
Git clone command constructed via template literal without shell escaping on parameters, which can lead to command injection (CWE-78/CWE-88).
Unescaped variable or array element concatenated into command execution function. This allows command and argument injection. Ensure all dynamic arguments are escaped using escapeshellarg().
YAML serialized configuration string is interpolated directly into a shell command string. Because YAML output can contain single quotes from user input that are not escaped for shell execution, this leads to OS command injection. Base64 encode the serialized output prior to command execution or avoid shell execution.
Direct invocation of `Command::new("git")` without overriding repository configuration options (e.g., `-c core.fsmonitor=false`) allows arbitrary code execution via malicious local `.git/config` files. Use a sanitized wrapper function or explicitly disable unsafe Git features such as `core.fsmonitor`.
A fixed-size error buffer smaller than XML_ERROR_SIZE (1024 bytes) is passed to lilxml's readXMLFile, leading to a stack buffer overflow when formatting XML error messages.
Database configuration values retrieved from custom resource environment variables or ConfigMaps are returned directly without validation. If these values are embedded in database initialization scripts or SQL queries, it can lead to command injection or SQL injection. Validate the input against an expected format or allowlist before use.
Heap buffer allocation size calculated from string length and un-escaped character counts may under-count required bytes when parsing complex path strings, leading to a heap out-of-bounds write.
JPEG 2000 SIZ marker parsing does not validate tile and image geometry, which can lead to out-of-bounds writes during block decoding.
OpenEXR channel was processed and added without validating that xSampling and ySampling are equal to 1. Combining scanline EXR images with subsampled channels and misaligned data windows can lead to heap out-of-bounds memory corruption.
Constructing CLI command list for grep without explicit '--' option delimiter allows argument injection if file paths or arguments start with hyphens.
A length parameter is clamped using `std::min` to calculate a safe length, but the original unclamped variable is passed to `memcpy`. This can cause an out-of-bounds read or write.
