Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Renderer-controlled URL is passed to shell.openExternal without protocol validation in an IPC handler. This may allow arbitrary URL schemes (e.g., file: or OS-registered handlers) to execute commands or access local files.
The application was found passing in a non-literal value to the `urllib` methods which issue requests. `urllib` supports the `file://` scheme, which may allow an adversary who can control the URL value to read arbitrary files on the file system. To remediate this issue either hardcode the URLs being used in urllib or use the `requests` module instead. Exampl
PythonCWE-939
