CWE-693: Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

This weakness covers three distinct situations. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.

Consequences

• Access Control: Bypass Protection Mechanism

Recent advisories

• GHSA-26mh-57q7-jfvr — PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
• GHSA-mrv2-3pqr-j5jr — DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
• GHSA-5r62-gj48-897x — Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
• GHSA-9jww-cxg5-rj9m — Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
• GHSA-76pm-mq2q-9gcr — Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
• GHSA-p2jm-6hj6-9rjg — AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
• GHSA-44g4-m2mj-wpvx — Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
• GHSA-gr2m-v5gq-v685 — Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
• GHSA-hq2x-r82h-9wj4 — Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
• GHSA-4hqw-qxg8-jxx2 — Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
• GHSA-w66g-j6c4-hcfc — MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
• GHSA-pq68-rvw4-xp4r — vm2 contains a sandbox escape vulnerability
• GHSA-f8gf-w286-fmq2 — vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
• GHSA-wjwh-qqvp-g4p4 — vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
• GHSA-633r-hq9m-c4ff — vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

All advisories for CWE-693