GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
4797
Downloads
12.1M
Verified
4797
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2025-64097: Elixir Insecure Token Generation Base62cve-2025-64097-elixir-insecure-token-generation-base62

A user/session/API token is generated using `:base62.encode/1` without sourcing entropy from `:crypto.strong_rand_bytes/1`. This pattern produces structurally-predictable tokens (especially when combined with HMAC over user-identifiable inputs) that are brute-forceable or enumerable (CVE-2025-64097, CWE-330). Replace the token body with `:crypto.strong_rand_

ElixirCVE-2025-64097GHSA-M9VJ-776Q-VC8MCWE-330
by Provallyupdated 2026-06-12Apache-2.0
3.5K0 direct3.5K via packs
76
All matching rules loaded.