Rule Explorer

Whitelisted endpoint passes a parameter to `frappe.render_template` without restricting access via `frappe.only_for`.

PythonCVE-2026-82634CWE-862CWE-94

Prompt string is rendered again through a template engine (`load_prompt_from_string`) with parameter values after prior template rendering. This second evaluation can allow Server-Side Template Injection (SSTI) if parameters contain template expressions.

PythonCVE-2026-82447CWE-1336CWE-94

CORS is configured with `origin: true` (which reflects any request origin) together with `credentials: true`. This allows any untrusted domain to make authenticated cross-origin requests and access sensitive data. Use an explicit origin whitelist or origin validation function instead of reflecting the Origin header.

TSCVE-2026-82291CWE-346CWE-942

CORS is configured to unconditionally allow any origin while enabling credentials. Reflecting arbitrary request origins with 'credentials: true' allows attackers on third-party sites to execute credentialed cross-origin requests and access sensitive user data.

TSfastifyCVE-2026-82287CWE-346CWE-942

Pandoc is invoked with a TeX/LaTeX PDF engine without explicitly disabling shell escape via '--pdf-engine-opt=-no-shell-escape'. Untrusted input containing TeX commands or LaTeX macros could execute arbitrary commands or read sensitive local files during PDF compilation.

PythonCVE-2026-81659CWE-200CWE-94

Equality filter optimization simplifies explicit comparison to implied equality without validating that document values do not contain '$'-prefixed keys. This allows MongoDB to interpret user-supplied keys as query operators, leading to NoSQL query injection.

C#CVE-2026-81527CWE-502CWE-943

MongoDB Collection constructor does not validate namespace identifiers against null bytes. Namespace identifiers containing null bytes can cause database operations to be redirected to unintended collections.

PHPCVE-2026-81525CWE-20CWE-943

Bulk write operations on ClientBulkWrite structs do not validate that database names are free of '.' characters. MongoDB server splits namespaces on the first period, so unvalidated database names containing '.' can retarget writes to unintended databases and collections.

GoCVE-2026-81521CWE-20CWE-943

Including 'getattr' or 'setattr' in a whitelist of safe builtins or allowed functions for sandboxed Python execution allows callers to bypass AST-level restrictions and access dangerous attributes or class hierarchies.

PythonCVE-2026-81096CWE-693CWE-94

Constructing SQLite JSON path expressions by joining path segments with `.` without quoting or escaping allows JSON path traversal and unauthorized data access.

ElixirCVE-2026-77846CWE-943

Detected `trust_remote_code=True` hardcoded in `from_pretrained(...)`. Enabling remote code execution unconditionally allows untrusted model repositories to execute arbitrary Python code. Gate `trust_remote_code` behind explicit user consent or a configuration check.

PythonCVE-2026-76841CWE-829CWE-94

Dynamic Twig template string is registered and rendered without enforcing a Twig SandboxExtension security policy. This may lead to Server-Side Template Injection (SSTI) and remote code execution if the input is editor- or user-controlled.

PHPCVE-2026-75574CWE-1336CWE-94

Returning early when traversing nested dictionary keys within a loop over multiple key paths aborts sanitization of subsequent keys. Use break/continue instead of returning immediately.

PythonCVE-2026-75149CWE-184CWE-670CWE-94

Calling `run_with_correction` with `sandbox=False` without restricting code execution `permission` allows execution of arbitrary Python code in the host process (CVE-2026-75062).

PythonCVE-2026-75062CWE-94CWE-95

Executing `eval` on elements iterated from a collection can lead to arbitrary code execution if untrusted string inputs are added to the collection. Store and invoke callable objects (e.g. Proc or Lambda) using `.call` or `&:call` instead of evaluating raw strings.

RubyRailsCVE-2026-73330CWE-94CWE-95

Replacing quotes with backticks without escaping backticks or template interpolation expressions (${...}) allows code injection when the generated template literal is evaluated. Use a dedicated escaping utility like jsesc.

TSCVE-2026-72716CWE-116CWE-94

Converting quotes to backticks via replace or replaceAll creates template literals without escaping interpolation sequences (`${...}`) or backticks. This allows code injection in generated JavaScript/TypeScript. Use a dedicated escaping function or library such as `jsesc`.

TSCVE-2026-71871CWE-116CWE-94

Replacing quote characters with backticks on stringified data without escaping template literal interpolations (`${...}`) or backticks can lead to arbitrary code execution in generated code. Use a secure escaping utility like `jsesc`.

TSCVE-2026-71869CWE-116CWE-94

Naively replacing quotes with backticks without escaping backslashes, backticks, or interpolation expressions (${...}) allows template literal injection when generating code. Use a secure escaping library such as 'jsesc' with backtick options instead.

JSCVE-2026-71864CWE-116CWE-94

The template filter regex attempts to block dangerous PHP keywords or functions via a blacklist, but omits 'exec'. Relying on incomplete blacklists allows attackers to execute arbitrary system commands via omitted execution functions.

PHPCVE-2026-71232CWE-184CWE-94

Unsandboxed Groovy script evaluation using groovy.util.Eval detected. Evaluating expressions with Eval executes code directly on the JVM without sandbox restrictions or Script Security approval, enabling arbitrary code execution. Use SecureGroovyScript with sandboxing enabled instead.

JavaCVE-2026-70432CWE-94CWE-95

The GitHub Actions workflow allows the Claude AI action to automatically trigger on untrusted pull requests. An attacker can utilize prompt injection in their pull request code to coerce the AI assistant into executing arbitrary shell commands on the runner. This can lead to sensitive secret compromise and unauthorized repository modification. Restrict the j

YAMLCVE-2026-67610CWE-94

Evaluating string values dynamically extracted from collections or iterators using `eval` is unsafe and exposes the application to arbitrary code execution (RCE) if user-controlled strings can be added to the collection (e.g., as callbacks or commands). Use Procs, Lambdas, or other callable constructs and invoke them via `.call` rather than storing code as s

RubyCVE-2026-66748CWE-94

Directly interpolating untrusted GitHub context values (such as pull request titles or issue bodies) into inline shell `run` commands allows command injection. Use an environment variable under `env:` instead.

YAMLCVE-2026-63187CWE-78CWE-94