CVE-2026-50149: Envoy Dynamic Script Code Injection
Dynamically constructing Envoy scripts (like Lua filters) via format strings or buffers allows code injection. An attacker can break out of string literals or inject arbitrary commands if untrusted input is interpolated into the script payload. Instead, pass configuration inputs cleanly through Envoy's FilterContext and read them inside static scripts using
Gogreprules fetch cve-2026-50149-envoy-dynamic-script-code-injection --engine opengrepDescription
Dynamically constructing Envoy scripts (like Lua filters) via format strings or buffers allows code injection. An attacker can break out of string literals or inject arbitrary commands if untrusted input is interpolated into the script payload. Instead, pass configuration inputs cleanly through Envoy's FilterContext and read them inside static scripts using
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.