CWE-184: Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Consequences

• Access Control: Bypass Protection Mechanism

How to prevent it

• Implementation: Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Recent advisories

• GHSA-26mh-57q7-jfvr — PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
• GHSA-cf23-7qxj-xmhr — Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
• GHSA-p8wg-vrv2-v86f — Handlebars: JavaScript Injection via Own Property Check Bypass
• GHSA-r7f2-6fj8-6fg2 — Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
• GHSA-v3xr-g6p2-fvgv — Ghost: Stored XSS via oEmbed Photo Responses
• GHSA-w66g-j6c4-hcfc — MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
• GHSA-w27v-7q3p-w38r — SVGO: removeScripts allows executable links through namespace and control-character bypasses
• PYSEC-2026-3763 — openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST…
• GHSA-957r-qf9p-67xw — Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
• GHSA-52fh-8v99-63c2 — Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
• GHSA-xc48-889x-5qmw — Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
• GHSA-6p8h-3wgx-97gf — GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
• GHSA-5qhf-9phg-95m2 — Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
• GHSA-2f96-g7mh-g2hx — GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
• GHSA-2p49-hgcm-8545 — SVGO removeScripts plugin leaves some executable scripts intact

All advisories for CWE-184