CWE-453: Insecure Default Variable Initialization

Variant

The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

Consequences

Integrity: Modify Application Data

How to prevent it

System Configuration: Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.

Recent advisories

GHSA-jxxv-8r27-vm4p — vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
GHSA-9gp8-hjxr-6f34 — OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls
GHSA-grw3-hjjm-5cjm — DotNetNuke Default Machine Key Exposure

All advisories for CWE-453

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor