Filtering Node.js builtin modules without excluding undocumented underscored modules (e.g., `_http_client`, `_http_server`) can allow sandbox bypasses. Underscored modules expose underlying network or system primitives directly and often circumvent restrictions placed on public modules. Ensure that elements starting with `_` are also filtered out.
Explore
Rule Explorer
Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
- Public rules
- 2917
- Downloads
- 3.6M
- Verified
- 2917
- Authors
- 2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
CVE-2026-47139: Node Builtin Modules Underscore Bypasscve-2026-47139-node-builtin-modules-underscore-bypass
CVE-2025-32445: Go Mergo Merge Container With Overridecve-2025-32445-go-mergo-merge-container-with-override
Using `mergo.Merge` with `mergo.WithOverride` to merge a user-supplied `Container` (typed as the upstream `k8s.io/api/core/v1.Container` or reachable through a CR `Spec.Template.Container`) into an operator-built container lets a low-privileged tenant override arbitrary container fields — image, command, args, securityContext (privileged/runAsUser/capabiliti
All matching rules loaded.