Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
An Axios request uses an overly permissive `validateStatus` function that permits HTTP 3xx status codes (e.g., `< 400`). When fetching untrusted URLs, accepting redirect statuses as successful resolutions can allow an attacker to bypass Server-Side Request Forgery (SSRF) protections or proxy unexpected content. Enforce explicit `maxRedirects` constraints and
Undocumented webBookmarkResignImage action enables SSRF/IDOR via metadata URL extraction and customized PresignedUrl generation
Direct use and persistence of unvalidated mirror/clone addresses can lead to Server-Side Request Forgery (SSRF) when the application later requests those URLs.
Using `URL.canParse()` to conditionally gate URL validation logic can cause a "fail-open" vulnerability. If a URL is malformed, `URL.canParse` returns false and the validation block is skipped. A downstream lenient parser could then successfully parse the skipped malicious URL, leading to SSRF or path hijacking. Ensure that the negative parse case (!URL.canP
Enabling CURLOPT_FOLLOWLOCATION without restricting allowable redirect protocols via CURLOPT_REDIR_PROTOCOLS_STR allows protocol smuggling or unintended SSRF to internal non-HTTP protocols. This application mitigates the issue by depending on libcurl >= 7.85. The current meson.build file specifies a version constraint older than 7.85, which risks re-introduc
An unvalidated Echo path parameter is interpolated directly into a path-like format string. If this string dictates downstream requests or file paths, attackers can leverage path traversal sequences (e.g. `../`) to manipulate endpoint boundaries, leading to Path Traversal or Server-Side Request Forgery risks. Ensure context parameters are validated against e
Direct injection of formula argument literal values (`.value`) into `knex.raw()`. This bypasses query parametrization and allows arbitrary SQL execution if a user provides malicious input. Validate the value against a strict allowedlist (e.g., 'asc', 'desc') before passing it to `knex.raw()`.
Multimodal tool results (e.g., URLs) are incorrectly extracted and added to user prompts. This can allow attackers to bypass tool-specific security validations (such as SSRF blocklists on URLs) because the contents are evaluated as standard user strings/comments rather than structured tool returns.
The application accepts and processes arbitrary URIs without performing validation against private/loopback addresses. This can lead to Server-Side Request Forgery (SSRF), allowing attackers to access internal services, link-local environments, and cloud metadata endpoints. Add URL validation logic before resolving or connecting.
Using `requests.Session().send()` without disabling redirects (`allow_redirects=False`) can lead to Server-Side Request Forgery (SSRF). Attackers can bypass URL validation by pointing to a server that responds with a redirect to an internal or restricted URL. Disable redirects during the `send()` call and optionally handle them manually after validation.
HTTP requests made to user-supplied URLs with automatic redirection enabled are vulnerable to Server-Side Request Forgery (SSRF). An attacker can supply an external URL that redirects to a sensitive internal or loopback IP address (like 169.254.169.254), bypassing preliminary URL validation. Disable automatic redirects by explicitly passing `allow_redirects=
Navigating to untrusted URLs using Playwright without configuring network route interception (`page.route()`) allows the rendered page to initiate sub-requests to local files (`file://`) or internal network resources. This can result in Server-Side Request Forgery (SSRF) or local file read vulnerabilities. Ensure proper routing rules are configured to interc
A URL validation check is performed before an HTTP request, but the original URL string is passed to the network client. If the validation performs an IP address check via DNS resolution, this pattern is susceptible to Time-of-Check to Time-of-Use (TOCTOU) DNS Rebinding attacks. To fix this, resolve the IP securely and pass the IP directly to the HTTP client
A URL is passed to fetch() after only a scheme-prefix check (startsWith("http://") or startsWith("https://")). RFC-1918 addresses, loopback (127.0.0.1), link-local (169.254.x.x), and cloud metadata endpoints all satisfy a scheme-only guard, enabling Server-Side Request Forgery. Resolve the URL hostname to an IP address and validate it against a blocklist of
Passing the result of `urljoin` directly into a `Path` object without validation can result in Path Traversal or Local File Inclusion (LFI). Python's `urljoin` ignores the base URI entirely if the target substring provides an absolute path or wrapper scheme. This allows attackers to specify arbitrary local paths out-of-bounds.
A Django REST Framework Create-style view (uses `CreateModelMixin`, `CreateAPIView`, or `ListCreateAPIView`) declares `permission_classes = [permissions.AllowAny]` while also defining a `serializer_class`, exposing a mutating/data-binding endpoint to anonymous callers. This is the unsafe pattern from CVE-2026-42864 (firefighter-incident `CreateJiraBotView`):
HTTP request issued with a URL taken from a user-supplied object attribute (field name matching *url or *uri) without SSRF validation. An attacker who controls this value can supply an internal address (127.0.0.1, RFC-1918, 169.254.169.254 cloud metadata endpoint) to make the server issue arbitrary internal HTTP requests. Resolve the hostname and verify the
Relying solely on `ipaddress.is_private` for SSRF protection is insufficient. The `is_private` property does not block all non-publicly routable IP ranges, such as the RFC 6598 Shared Address Space (100.64.0.0/10) or multicast addresses. An attacker could exploit this to bypass SSRF filters and access internal services. Augment `is_private` with checks for m
Unvalidated user input is passed directly to `CURLOPT_URL` without network validation. This acts as a vector for Server-Side Request Forgery (SSRF). In the absence of strict URL parameter limitation or DNS rebinding protections like `CURLOPT_RESOLVE`, an attacker can leverage the server to traverse and issue requests to internal automated services.
Directly casting the result of `atoi()` to a 16-bit integer (like `unsigned short`) can lead to integer truncation if the parsed value exceeds 65535. This type of truncation in port parsing is a common cause of Server-Side Request Forgery (SSRF) port confusion vulnerabilities. Ensure the parsed integer is bounds-checked before being cast, for example by usin
The application reads a local file path derived from a URI's `LocalPath` or `AbsolutePath` without first evaluating an authorization or configuration check. When a generic URI handler attempts to support the `file://` scheme, attackers can supply a local path to induce Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI). Validate the user's aut
Explicitly handling the "file" scheme from a generic URI without validating the inner `.LocalPath` against a configured allowlist or sandbox directory can lead to Arbitrary File Read and Path Traversal vulnerabilities. Ensure local file access is appropriately guarded with explicit permission checks or path validation.
Unconditionally opening a local file stream from a `Uri` without authorization limits allows attackers to read or include arbitrary local files. Introduce validation checks before using `Uri.LocalPath`.
Directly using an untrusted `Uri.LocalPath` inside a code branch that explicitly processes the "file" scheme can lead to Arbitrary File Read or SSRF against the local file system. Ensure an authorization or configuration safety check is performed before instantiating the file stream.
