Skip to content
Log inStart free trial

CWE-183: Permissive List of Allowed Inputs

Base

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Consequences

  • Access Control: Bypass Protection Mechanism

Recent advisories

  • GHSA-h3rc-j82p-2c3h — vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
  • GHSA-5hx5-vpf9-5wcv — pypdf: Unvalidated JPEG image data loading
  • GHSA-5qr9-xxm9-6cmq — Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability
  • GHSA-f4gw-2p7v-4548 — Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
  • GHSA-87qc-fj39-wccr — Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
  • GHSA-g8m3-5g58-fq7m — undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
  • GHSA-fg94-h982-f3mm — Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
  • GHSA-f26g-jm89-4g65 — gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules
  • GHSA-pmwg-cvhr-8vh7 — Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
  • GHSA-xx6v-rp6x-q39c — Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
  • GHSA-h7mw-gpvr-xq4m — DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
  • GHSA-f934-5rqf-xx47 — OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths
  • GHSA-49cg-279w-m73x — OpenClaw: Empty approver lists could grant explicit approval authorization
  • GHSA-cjmm-f4jc-qw8r — DOMPurify ADD_ATTR predicate skips URI validation
  • GHSA-j7p2-qcwm-94v4 — OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

All advisories for CWE-183

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor