Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Unescaped iteration variables flow into OS command execution. An attacker who controls the iterated array or configuration can inject arbitrary shell commands or overwrite arguments. Ensure array or iterable variables are rigorously sanitized using `escapeshellarg()` or `escapeshellcmd()` before being concatenated into a command string for shell execution fu
Missing `--` end-of-options separator in git commands makes the application vulnerable to git argument injection. If user-controlled values, such as a revision or repository URL, begin with `-`, git may execute arbitrary commands (e.g. via `--upload-pack`). Always insert `--` before passing dynamically constructed variables.
Constructing shell commands by concatenating executable paths and arguments with a space without proper context-aware shell escaping can lead to command injection. Likewise, using a shell metacharacter blocklist regex that misses newlines (\\n) and carriage returns (\\r) allows attackers to supply multiline inputs and bypass validation.
Passing dynamically constructed commands to an intermediate shell ("sh -c" or similar) introduces the risk of command injection. If variables or stdin are not strictly controlled, attackers may execute arbitrary commands by breaking out of the intended shell statement. Use `exec.Command` directly without a shell wrapper and pass arguments natively (e.g., aft
Validation of Git arguments using the regex `/^\s*-u\b/` is insufficient to prevent dangerous option injection. Git allows single-letter options to be grouped (e.g., `-vu`, `-4u`), which bypasses this regex check. Attackers could execute arbitrary code by passing a modified `-u` (upload-pack) option. Use a more robust check that accounts for Git's option gro
A constant set of "dangerous" Windows shell metacharacters used for caret-prefix escaping ('^X') contains the double-quote character ('"'). Caret escaping is only honored by cmd.exe. Native Win32 binaries (e.g. php-cgi.exe and any CGI interpreter built with the MSVCRT runtime) parse their command line via CommandLineToArgvW, which only recognises '\"' as an
Git argument injection detected. A user-controlled variable is passed to a git command without using the `--` end-of-options separator. This can allow an attacker to inject git command-line flags (e.g., `--upload-pack`) leading to remote code execution. Ensure `--` is used before any dynamic arguments.
An incomplete regular expression is used to check for characters that require escaping when spawning processes on Windows. This misses characters like '=', '[', ']', ';', '*', '?', '\'', and '$' which are treated as special by MSYS2 environments. Executing commands with these unquoted special tokens can lead to argument truncation, environment modification,
Constructing Git commands with unpacked variables without using the `--` end-of-options separator can lead to argument injection. If user-controlled elements in the list begin with `-` or `--`, they may be evaluated as Git options rather than positional arguments (e.g., file paths). Add `"--"` before the unpacked list elements to ensure they are interpreted
The `Picker.route` router unsafely merges query string parameters into the `params` callback argument, leading to parameter pollution and potential NoSQL injection. Attackers can inject query string payloads incorporating object operators (e.g., `?id[$ne]=1`) which execute in place of standard URL path variables, thereby overriding database query structures
A map-based allowlist validation or authorization check was bypassed using a broad string prefix match (`strings.HasPrefix`). If this logic is used to filter incoming parameters (e.g., HTTP arguments), attackers could supply undeclared inputs that bypass validation simply by matching the expected prefix. This unvalidated input can lead to critical vulnerabil
A variadic execution function (`execl`, `execlp`, `execle`) calls `login` with dynamically sized arguments but does not specify the end-of-options delimiter (`--`). This exposes the program to argument injection vulnerabilities (CWE-88). An attacker providing user input starting with `-` can inject flags, such as `-froot` to force an unauthenticated login by
Constructing inline standard input (heredocs) for pipelines using double-quoted string interpolation (e.g., `"<<[join ...]"` or `"<<$var"`) without `list` protection can lead to OS command injection in Tcl. When this string is evaluated in a command pipeline (such as via `open |` or `exec`), literal newlines or pipe metacharacters (`|`) within the string are
Cloudinary SDKs before 2.7.0 are vulnerable to Arbitrary Argument Injection in the `api_sign_request` function. The function concatenates parameter keys and values without properly escaping ampersands (`&`), allowing attackers to inject additional parameters (e.g. `&overwrite=true`) if parameter values are user-controlled. Use the built-in `verify_api_respon
Directly using `child_process.spawn` with `cmd.exe` and passing dynamically constructed arguments leads to Command Injection on Windows. `spawn` does not appropriately escape arguments for `cmd.exe`. Malicious inputs containing characters like `&`, `|`, or `;` can execute arbitrary commands alongside the intended one. Use `child_process.exec` with careful ma
Constructing a JDBC URI dynamically by passing unsanitized input as the Schema Specific Part (SSP) can lead to parameter injection. Attackers can embed query parameters (e.g., '?enable_load_extension=true' for SQLite) to alter database connection behavior or potentially execute arbitrary code. Ensure user input does not contain '?' characters, or append expl
Calling `URI.open` with a user-controlled string variable can result in arbitrary OS command execution if the string begins with a pipe character (`|`). To safely fetch URLs, parse the string into a URI object first using `URI(url).open` or `URI.parse(url).open`.
Detected an incomplete escaping mechanism for Windows cmd.exe. Replacing double quotes with '""' or constructing an invocation like `/c "{args}"` using an f-string is vulnerable to command injection. Double quotes do not prevent the expansion of environment variables like `%VAR%` under cmd.exe, allowing attackers to execute arbitrary shell commands. Ensure `
A boolean function checks for help flags ("--help" or "-h") using a generic list Contains method. This pattern causes parser desynchronization (also known as argument injection or bypasses) when placed alongside a strict argument parser. An attacker can append `-- --help` so the manual check returns true, but the underlying CLI ignores `--help` as a flag and
Constructing shell command strings dynamically with `g_strdup_printf` and passing them to execution or parsing mechanisms like `g_shell_parse_argv` or `g_spawn_command_line_sync` is vulnerable to argument injection. An attacker can supply a filename starting with a dash (`-`) that will be interpreted as a command option, leading to arbitrary code execution.
The application was found including unvalidated user input into a URL, which could lead to HTTP Parameter Pollution (HPP) or worse, Server Side Request Forgery (SSRF). This could allow an adversary to override the value of a URL or a request parameter. HTTP Parameter Pollution (HPP) attacks consist of injecting encoded query string delimiters into other exis
JavaCWE-88Concatenating unvalidated user input into a URL can allow an attacker to override the value of a request parameter. Attacker may be able to override existing parameter values, inject a new parameter or exploit variables out of a direct reach. HTTP Parameter Pollution (HPP) attacks consist of injecting encoded query string delimiters into other existing param
KotlinCWE-88Concatenating unvalidated user input into a URL can allow an attacker to override the value of a request parameter. Attacker may be able to override existing parameter values, inject a new parameter or exploit variables out of a direct reach. HTTP Parameter Pollution (HPP) attacks consist of injecting encoded query string delimiters into other existing param
ScalaCWE-88
