Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Direct assignment of joined array content to innerHTML or outerHTML bypasses HTML encoding and can lead to Cross-Site Scripting (XSS). If the array contains untrusted or user-controlled input, such as unescaped component slots, an attacker can execute arbitrary scripts via implicitly closed tags. Use textContent instead to safely encode the data as plain tex
The code relies on blocklisting specific HTML tags or attributes (such as `[onerror]` or `[href^=javascript]`) to sanitize untrusted input. This approach is inherently incomplete and easily bypassed by attackers using different executable constructs (e.g., `srcdoc`, `formaction`, data URIs). To properly sanitize HTML, use a well-tested library like DOMPurify
HTML content is assigned to the report object model without sanitization. This directly causes Stored XSS when the Allure report is generated and viewed on the frontend. Ensure the content is passed through an HTML sanitizer such as `HtmlSanitizerUtils.sanitizeHtml()` before assignment.
Insecure OR query exposing all personal projects due to array syntax in TypeORM `where`.
Unvalidated dictionary keys in query-parsing are directly formatted into `frappe.throw`, which can lead to Stored XSS or SQL injection. Ensure uppercase functions/keys are validated (e.g., using `child_field.isupper()`) before throwing errors.
Selecting a component host element dynamically using `selectRootElement` with a variable selector bypasses tag name validation and allows XSS. Attackers could direct the component to mount onto a `<script>` tag, resulting in script execution when internal properties are rendered natively. Ensure that the selected element's `tagName` is re-validated against `
Validation or sanitization of an HTML attribute without contextual element metadata can lead to schema bypasses. Always ensure attribute validation checks include the tag context, as safety profiles differ significantly (e.g., `href` on `a` versus `href` on `link`).
Attribute sanitization logic relies solely on the attribute name, ignoring the tag name. This can lead to XSS if namespace-specific tags (e.g., `<svg:animate>`) contextually change the security implications of an attribute. Ensure that sanitization schema lookup incorporates the element tag name or namespace.
Tornado framework's error handling accepts and processes custom HTTP reason phrases without sufficient validation against Control Characters like CRLF (leading to HTTP Header Injection) or escaping before embedding into HTML response bodies (Cross-Site Scripting). Ensure that custom reason phrases are properly validated (e.g., matching a strict ABNF token pa
A JWT secret is loaded from configuration or environment and used without explicit length or weakness validation. If the variable is unset or overridden with weak values (e.g., an empty string), an attacker can forge valid JWTs to bypass authentication. Verify the length and strength of the secret before initializing the JWT instance.
Direct construction of an AstNode with an unvalidated attribute bypasses schema validation, leading to stored XSS when the node is serialized. Construct a DOM element safely and use Sanitize.parseAndSanitize(..., element.outerHTML) instead.
Reconstructing HTML elements by dynamically stripping prefixes from attribute names and assigning them directly to objects without sanitizing the reconstructed full element can lead to Stored XSS. Attackers can smuggle attributes like `onclick` or `href` using expected user-controlled prefixes. Ensure that the full element (`outerHTML`) is sanitized instead
Extracting and un-prefixing attributes dynamically (e.g., from 'data-mce-p-onclick' to 'onclick') and assigning them directly to an AST node via `.attr()` without passing the resulting structure through a sanitizer can lead to stored XSS. Pre-fixed attributes are normally allowed by HTML sanitizers; stripping their prefixes bypasses this security check. Inst
Unvalidated dictionary keys from user-controlled input are passed directly to the `ChildQuery` structure. An attacker can inject arbitrary SQL functions or logic by manipulating these dictionary keys. Dictionary keys supplied via JSON or API requests must be validated (e.g. by rejecting uppercase SQL function names using `.isupper()`) before query constructi
Unsanitized search result titles from indexed search (`item_title` or `titleaddition`) are rendered as raw HTML via `linkPage()`, leading to Cross-Site Scripting (XSS). Ensure the item title is properly encoded using `htmlspecialchars()` before use.
Classes extending `Masterminds\HTML5\Serializer\OutputRules` but failing to override `namespaceAttrs` may serialize namespace attributes (like `xmlns:*`) directly to the output without context-aware HTML encoding. If this class is used within an HTML sanitization mechanism, this omission can lead to Cross-Site Scripting (XSS) via maliciously crafted namespac
The HTML tokenizer incorrectly fails to recognize whitespace-variant closing tags for raw-text elements, and the rules engine fails to properly restrict insecure raw-text elements when they are unsafely nested within a <noscript> tag context. TYPO3\HtmlSanitizer\Parser\Html5 should be used instead of Masterminds\HTML5.
The endpoint 'webBookmarkResignImage' has been completely removed in the patch due to an IDOR/Path Traversal vulnerability.
Direct base64 encoding of an uploaded file without prior MIME type or content validation. If this base64 string is rendered inline as a data URI, unrestricted SVG uploads could lead to Stored XSS. Ensure the uploaded file is validated using `$validator->validate(...)` or functions like `getimagesize()` before reading its contents.
Svelte's {@html ...} directive renders raw HTML/SVG verbatim and bypasses Svelte's automatic escaping. In an SVG pan/zoom component the `svg` value typically originates from chat / message content that an authenticated user (or an AI prompted by such a user) can influence. Because SVG legally embeds <foreignObject>, inline event handlers, and <script>, passi
The HTML returned by excelToTable() is assigned to a variable without DOMPurify.sanitize(). When that variable is rendered via Svelte's {@html ...} directive, attacker-controlled spreadsheet markup (e.g., <img onerror=...>) executes JavaScript in the victim's origin (DOM XSS). Wrap result.html with DOMPurify.sanitize(...) before assignment, as in the CVE-202
FileResponse is returned from a `{...:path}`-parameterized route without a `headers=` argument forcing `Content-Disposition: attachment` and `X-Content-Type-Options: nosniff`. Starlette derives Content-Type from the on-disk file extension, so if any user-influenced file (e.g. a cached upload) has an HTML or SVG extension on disk, the browser will render it i
Flot chart's `tickFormatter` config option renders output as HTML by default. Returning unescaped dynamically constructed strings (e.g., via template literals or string concatenation) inside the formatter can lead to Stored Cross-Site Scripting (XSS). Ensure all dynamic data interpolated or concatenated into output strings is passed through an HTML safety fu
This regex pattern for an inline delimited span uses `.+?` which does not atomically consume backslash-escape sequences. An attacker can craft input like `$\$<payload>` to split the escape sequence `\$` across the match boundary: the `\` is absorbed as math content while the `$` closes the span prematurely. Content that should be inside the sanitized span is
