Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Invoking the native 'zip' command without a '--' delimiter before dynamic file sources can lead to argument injection and command execution via crafted file names or options such as '-T' and '-TT'.
Calling `Repo.clone` or `Repo.clone_from` with `allow_unsafe_options=True` disables validation against dangerous git clone options (such as `--config`, `--template`, and `--separate-git-dir`). If arguments or options are derived from untrusted input, this can lead to argument injection, arbitrary file overwrite, or remote code execution.
Allowed binary command configuration does not validate or reject dangerous command-line options, allowing potential argument injection / arbitrary file write.
Git clone command constructed via template literal without shell escaping on parameters, which can lead to command injection (CWE-78/CWE-88).
Unescaped variable or array element concatenated into command execution function. This allows command and argument injection. Ensure all dynamic arguments are escaped using escapeshellarg().
Unsanitized input formatted into OpenSSL subprocess command line arguments can lead to argument injection or path traversal vulnerabilities.
Bypassing argument or parameter map filtering by allowing any key with a specific prefix allows untrusted user input to skip type safety and validation checks.
Constructing CLI command list for grep without explicit '--' option delimiter allows argument injection if file paths or arguments start with hyphens.
Unescaped CLI arguments from $argv are passed directly to a system command execution function, which can lead to command injection. Use escapeshellarg() or escapeshellcmd() to sanitize arguments.
Extracted IP address field from JSON is returned without IP format validation, which can allow command argument injection if used in privileged commands.
Argument injection vulnerability. Only the first token of parsed arguments is validated, leaving subsequent arguments unvalidated.
Bracketed host parsing removes brackets without validating that the extracted hostname does not begin with a hyphen ('-'). This can allow command-line argument injection if the hostname is passed to external commands such as ssh.
Unescaped iteration variables flow into OS command execution. An attacker who controls the iterated array or configuration can inject arbitrary shell commands or overwrite arguments. Ensure array or iterable variables are rigorously sanitized using `escapeshellarg()` or `escapeshellcmd()` before being concatenated into a command string for shell execution fu
Missing `--` end-of-options separator in git commands makes the application vulnerable to git argument injection. If user-controlled values, such as a revision or repository URL, begin with `-`, git may execute arbitrary commands (e.g. via `--upload-pack`). Always insert `--` before passing dynamically constructed variables.
Constructing shell commands by concatenating executable paths and arguments with a space without proper context-aware shell escaping can lead to command injection. Likewise, using a shell metacharacter blocklist regex that misses newlines (\\n) and carriage returns (\\r) allows attackers to supply multiline inputs and bypass validation.
Passing dynamically constructed commands to an intermediate shell ("sh -c" or similar) introduces the risk of command injection. If variables or stdin are not strictly controlled, attackers may execute arbitrary commands by breaking out of the intended shell statement. Use `exec.Command` directly without a shell wrapper and pass arguments natively (e.g., aft
Validation of Git arguments using the regex `/^\s*-u\b/` is insufficient to prevent dangerous option injection. Git allows single-letter options to be grouped (e.g., `-vu`, `-4u`), which bypasses this regex check. Attackers could execute arbitrary code by passing a modified `-u` (upload-pack) option. Use a more robust check that accounts for Git's option gro
A constant set of "dangerous" Windows shell metacharacters used for caret-prefix escaping ('^X') contains the double-quote character ('"'). Caret escaping is only honored by cmd.exe. Native Win32 binaries (e.g. php-cgi.exe and any CGI interpreter built with the MSVCRT runtime) parse their command line via CommandLineToArgvW, which only recognises '\"' as an
Git argument injection detected. A user-controlled variable is passed to a git command without using the `--` end-of-options separator. This can allow an attacker to inject git command-line flags (e.g., `--upload-pack`) leading to remote code execution. Ensure `--` is used before any dynamic arguments.
An incomplete regular expression is used to check for characters that require escaping when spawning processes on Windows. This misses characters like '=', '[', ']', ';', '*', '?', '\'', and '$' which are treated as special by MSYS2 environments. Executing commands with these unquoted special tokens can lead to argument truncation, environment modification,
Detected an OpenSSL subprocess array executing with unvalidated input paths or parameters. This can lead to arbitrary file writes via -out/-keyout, path traversal via -in, or argument injection via -subj/-addext. Ensure all untrusted inputs are validated or sanitized before passing them to the OpenSSL command list.
Constructing Git commands with unpacked variables without using the `--` end-of-options separator can lead to argument injection. If user-controlled elements in the list begin with `-` or `--`, they may be evaluated as Git options rather than positional arguments (e.g., file paths). Add `"--"` before the unpacked list elements to ensure they are interpreted
The `Picker.route` router unsafely merges query string parameters into the `params` callback argument, leading to parameter pollution and potential NoSQL injection. Attackers can inject query string payloads incorporating object operators (e.g., `?id[$ne]=1`) which execute in place of standard URL path variables, thereby overriding database query structures
A map-based allowlist validation or authorization check was bypassed using a broad string prefix match (`strings.HasPrefix`). If this logic is used to filter incoming parameters (e.g., HTTP arguments), attackers could supply undeclared inputs that bypass validation simply by matching the expected prefix. This unvalidated input can lead to critical vulnerabil
