Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Envelope size is concatenated directly into SMTP command arguments without numeric coercion, which may allow SMTP command injection via CRLF sequences.
Email header comment string is formatted into headers without stripping CRLF sequences, potentially allowing email header injection (CWE-93, CWE-113).
Git config values are serialized without quoting comment characters ('#', ';') or edge whitespace, which can lead to config directive injection.
Calling `getHeadersString()` without a sanitization callback allows CRLF sequences in custom email headers to cause email header injection. Provide a sanitizer callback as the third argument to strip `\r\n` characters.
HTTP/2 header parsing does not validate header field values for CR, LF, or NUL characters (RFC 9113 §8.2.1). Unsanitized control characters in request headers can lead to log injection, HTTP request smuggling, or response splitting downstream.
RFC 5424 structured data escaping only replaces backslashes, double quotes, and closing brackets, but does not sanitize C0 control characters (0x00-0x1F) such as newlines. In syslog framing (RFC 6587), unescaped newlines can terminate frames and allow log injection or frame forgery. Ensure all control characters are neutralized.
Constructing protocol commands by joining unvalidated arguments and appending CRLF sequences can lead to protocol injection (e.g., SMTP/HTTP injection) if the arguments contain control characters. Ensure arguments are validated for prohibited characters (like CR and LF) before concatenation.
Renderer-controlled URL is passed to shell.openExternal without protocol validation in an IPC handler. This may allow arbitrary URL schemes (e.g., file: or OS-registered handlers) to execute commands or access local files.
Detected potentially unsafe generation of an aria2c input list file. Formatting an unsanitized URL alongside `\\n\\tout=` allows CRLF injection, letting attackers inject arbitrary aria2c options (such as arbitrary file writes or executing scripts via `on-download-complete`). In yt-dlp, this led to RCE via attacker-controlled DASH/HLS manifests (CVE-2026-5057
Missing sanitization of HTTP header values assigned to CURLOPT_HTTPHEADER can lead to HTTP header injection (CRLF injection). Attackers can inject carriage returns and line feeds to manipulate outgoing HTTP requests.
A variable is appended to a list after validating only that it is not empty. When handling inputs like parsed URIs from untrusted payloads, checking for `.empty()` or `.size() > 0` is insufficient to prevent control-character injections (such as CRLF). Ensure the input is explicitly validated against newlines and appropriate semantic constraints.
Server-Sent Events (SSE) data escaping only replaces LF ('\n') with the data field prefix, ignoring carriage return ('\r' / '\r\n') line breaks. This can lead to SSE frame corruption or injection if user input contains carriage return characters.
record_metric assembles a StatsD wire-protocol datagram by concatenating $metric and $suffix into "<prefix><metric>:<value><suffix>\n" without validating them against the StatsD protocol delimiters newline (\n), colon (:), and pipe (|). Untrusted metric names containing these characters can inject additional StatsD metrics into the same UDP packet, poisoning
Unsanitized user input reaches email headers in build_message() without CRLF cleanup, which can allow CRLF injection to inject arbitrary email headers or alter message structure.
Binary data is validated or split on newline ("\n") without handling carriage returns ("\r" or "\r\n"). In protocols like SSE and HTTP, bare carriage returns are treated as line terminators and can allow CRLF injection or message splitting.
A topic/manifest entry obtained from a remote source is appended to the enabled list without verifying that its `name` field is free of control characters. Newlines or other control characters in `name` can break out of the intended APT sources.list line and inject arbitrary `deb`/`deb-src` entries into /etc/apt/sources.list.d (CVE-2026-39958). Validate the
The code checks for the presence of newline characters ('\n') but fails to check for carriage returns ('\r'). In contexts where HTTP headers or status lines are constructed, failing to reject '\r' allows an attacker to inject HTTP control characters, leading to HTTP Response Splitting or CRLF injection. Ensure that both '\r' and '\n' are validated.
A function parameter is assigned to a header dictionary (e.g., content_type) without prior verification for carriage return ('\r') or newline ('\n') characters. If attacker-controlled, this can lead to header injection or multipart structure corruption.
Direct concatenation of variables into an HTTP header string without sanitization can lead to CRLF injection.
Field '$NAME' in data model uses unvalidated StringDataValue instead of StrictStringDataValue for sensitive APT directives. This can allow control character injection (such as newlines) leading to arbitrary APT repository or package injection.
Database-derived ID3 tag value (artist / album_artist / artist_sort / album_artist_sort / album / title / genre) is written into a newline-delimited MPD response via evbuffer_add_printf without sanitizing embedded newline characters. A media file with a crafted tag containing '\n' will inject extra MPD response lines and corrupt the line-based protocol frami
When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content. Inserted false entries could be used to skew statistics, distract the administrator or even to implicate another party in the commission of a malicious act. If the log file is processed automatically, the at
ScalaCWE-93The application was found passing in a non-literal value to the `urllib` methods which issue requests. `urllib` supports the `file://` scheme, which may allow an adversary who can control the URL value to read arbitrary files on the file system. To remediate this issue either hardcode the URLs being used in urllib or use the `requests` module instead. Exampl
PythonCWE-939
