Skip to content
Log inStart free trial

CWE-1188: Initialization of a Resource with an Insecure Default

Base

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Consequences

  • Other: Varies by Context

Recent advisories

  • GHSA-9qh4-3jw8-366w — Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
  • GHSA-jxxv-8r27-vm4p — vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
  • GHSA-p3m8-78j2-g5p3 — NLTK: Default ENFORCE=False Disables All pathsec Security Controls
  • GHSA-xr9x-r78c-5hrm — Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
  • GHSA-jr9p-4h4j-6c58 — Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
  • GHSA-fj8f-m44g-c479 — PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
  • GHSA-9h47-pqcx-hjr4 — Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
  • GHSA-5xfx-xj4h-5p7r — SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
  • GHSA-mvjr-vv3c-w4qv — SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
  • GHSA-p4m3-mgmm-c664 — SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
  • GHSA-cwj8-7gp2-ggcw — praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
  • GHSA-f38v-77qj-h4jq — praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
  • GHSA-j4hj-7hfh-g2f4 — praisonai: recipe serve auth middleware silently disables itself when no secret is set
  • GHSA-qhr7-h655-pw6r — Apache Solr has hardcoded credentials in the Basic Authentication setup tool
  • GHSA-8444-4fhq-fxpq — PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

All advisories for CWE-1188

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor