Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 504

504 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
Confidentiality Read Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access Control Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Other Alter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, Other Other
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation Hide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
Requirements Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID Title CVSS Severity Published
CVE-2026-4511 vanna-ai vanna legacy exec injection — vanna 6.3 Medium 2026-03-21
CVE-2026-4500 bagofwords1 bagofwords code_execution.py generate_df injection — bagofwords 6.3 Medium 2026-03-20
CVE-2026-32616 Pigeon has a Host Header Injection in email verification flow — Pigeon 8.2 High 2026-03-13
CVE-2026-3992 CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection — serverless-express 6.3 Medium 2026-03-12
CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values — traefik 5.4AI Medium AI 2026-03-11
CVE-2026-31816 Budibase Universal Auth Bypass via Webhook Query Param Injection — budibase 9.1 Critical 2026-03-09
CVE-2026-3813 opencc JFlow WF_CCForm.java Calculate injection — JFlow 6.3 Medium 2026-03-09
CVE-2026-29053 Ghost Vulnerable to Remote Code Execution via Malicious Themes — Ghost 7.7 High 2026-03-05
CVE-2026-29085 Hono: SSE Control Field Injection via CR/LF in writeSSE() — hono 6.5 Medium 2026-03-04
CVE-2026-26002 OnDemand susceptible to malicious input when navigating to a directory. — ondemand 8.0AI High AI 2026-03-04
CVE-2026-25750 LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl — helm 8.9AI High AI 2026-03-04
CVE-2026-27148 Storybook Dev Server Vulnerable to WebSocket Hijacking — storybook 8.1AI High AI 2026-02-25
CVE-2026-27727 mchange-commons-java: Remote Code Execution via JNDI Reference Resolution — mchange-commons-java 8.9 High 2026-02-25
CVE-2025-67733 Valkey Affected by RESP Protocol Injection via Lua error_reply — valkey 8.5 High 2026-02-23
CVE-2026-2954 Dromara UJCMS ImportDataController import-channel importChanel injection — UJCMS 6.3 Medium 2026-02-22
CVE-2026-27194 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint — dtale 9.8 - 2026-02-21
CVE-2026-27022 RediSearch Query Injection in @langchain/langgraph-checkpoint-redis — langgraphjs 6.5 Medium 2026-02-20
CVE-2026-24764 OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions — clawdbot 3.7 Low 2026-02-19
CVE-2026-2019 Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting — Cart All In One For WooCommerce 7.2 High 2026-02-18
CVE-2026-2469 ImapEngine 安全漏洞 — directorytree/imapengine 7.6 High 2026-02-14
CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters — assessment-placipy 7.1AI High AI 2026-02-09
CVE-2026-25586 SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution — SandboxJS 10.0 Critical 2026-02-06
CVE-2026-25520 SandboxJS has a Sandbox Escape — SandboxJS 10.0 Critical 2026-02-06
CVE-2026-24043 jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation) — jsPDF 7.6AI High AI 2026-02-02
CVE-2025-41083 Improper Neutralization in Altitude Communication Server — Altitude Communication Server 6.1AI Medium AI 2026-01-26
CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover — horilla 8.0AI High AI 2026-01-22
CVE-2026-24002 pyodide sandbox option is insecure — grist-core 9.1 Critical 2026-01-22
CVE-2026-0865 wsgiref.headers.Headers allows header newline injection — CPython 4.7AI Medium AI 2026-01-20
CVE-2026-22200 osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read — osTicket 6.5AI Medium AI 2026-01-12
CVE-2025-67746 Composer vulnerable to ANSI sequence injection — composer 8.1 - 2025-12-30

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 504 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.