CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
Base
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Consequences
- Access Control, Integrity: Bypass Protection Mechanism, Modify Application Data
Recent advisories
- GHSA-q54r-jf2p-rfr2 — gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
- GHSA-g8wj-3cr3-6w7v — Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- GHSA-3g8h-86w9-wvmq — Next.js's Middleware / Proxy redirects can be cache-poisoned
- GHSA-f26g-jm89-4g65 — gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules
- GHSA-rxmx-g7hr-8mx4 — OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
- GHSA-m3mh-3mpg-37hw — OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
- GHSA-jvhm-gjrh-3h93 — Nuxt allows DOS via cache poisoning with payload rendering response
- GHSA-gp8f-8m3g-qvj9 — Next.js Cache Poisoning
- GHSA-cwh2-q44x-5w3c — Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability
- GHSA-8wgj-6wx8-h5hq — Symfony HTTP Foundation web cache poisoning
- GHSA-q7q2-qf2q-rw3w — Django Vulnerable to Cache Poisoning
- GHSA-rm2j-x595-q9cj — Django Vulnerable to Cache Poisoning
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor