Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 433

433 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
ConfidentialityRead Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
OtherAlter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, OtherOther
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
RequirementsProgramming languages and supporting technologies might be chosen which are not subject to these issues.
ImplementationUtilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE IDTitleCVSSSeverityPublished
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution — logging-operator 9.9 Critical2026-07-29
CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields — undici 4.8 Medium2026-07-29
CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-54664 swagger-typescript-api vulnerable to code injection via unescaped enum string values — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template — swagger-typescript-api 8.3 High2026-07-29
CVE-2026-18085 Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM — UEM 5.9 Medium2026-07-28
CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE — ps_facetedsearch 10.0 Critical2026-07-17
CVE-2026-44182 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering — enterprise_gateway--2026-07-16
CVE-2026-56699 Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index — wazuh 10.0 Critical2026-07-15
CVE-2026-58493 grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction — grav--2026-07-10
CVE-2026-55615 Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 — langroid--2026-07-09
CVE-2026-0284 PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) — Cloud NGFW--2026-07-09
CVE-2026-58213 NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection — nats-server 7.1 High2026-07-08
CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output — yt-dlp 7.5 High2026-07-08
CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` — coder 8.3 High2026-07-07
CVE-2026-49099 Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour — Apache Camel Salesforce--2026-07-06
CVE-2026-48203 Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields — Apache Camel--2026-07-06
CVE-2026-14249 Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter — Request a Quote – Quote Forms for Any WordPress Site 7.5 High2026-07-02
CVE-2026-57522 Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates — server 3.5 Low2026-06-25
CVE-2026-50574 yt-dlp: Arbitrary code execution via manifest downloads with aria2c — yt-dlp 8.3 High2026-06-23
CVE-2026-12888 HTML injection in the Canarytoken Google Chat notification — Canarytokens--2026-06-22
CVE-2026-50107 NGINX Gateway Fabric vulnerability — NGINX Gateway Fabric 8.1 High2026-06-17
CVE-2026-20220 Cisco Crosswork Network Controller Remote Code Execution Vulnerability — Cisco Crosswork Network Change Automation 6.3 Medium2026-06-17
CVE-2026-54231 Abrt: unsanitized systemd journal content written to dump directory files enables content injection — Red Hat Enterprise Linux 6 5.5 Medium2026-06-13
CVE-2026-47162 Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name — vim--2026-06-11
CVE-2026-11859 HTML injection in the Canarytoken links email — Canarytokens--2026-06-10
CVE-2026-46546 Frappe LMS: HTML injection in user-controlled metadata — lms--2026-06-09
CVE-2026-47634 Microsoft SharePoint Server Spoofing Vulnerability — Microsoft SharePoint Server 2019 7.3 High2026-06-09
CVE-2026-42835 Microsoft Teams for Android Information Disclosure Vulnerability — Microsoft Teams for Android 8.1 High2026-06-09

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 433 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.