Skip to content
Log inStart free trial

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

ClassLikelihood of exploit: High

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Consequences

  • Confidentiality: Read Application Data
  • Access Control: Bypass Protection Mechanism
  • Other: Alter Execution Logic
  • Integrity, Other: Other
  • Non-Repudiation: Hide Activities

How to prevent it

  • Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Recent advisories

  • GHSA-j8rh-479h-cp32 — Axios: Header Injection via Inherited headers After Minimal Interceptor
  • GHSA-4hqw-qxg8-jxx2 — Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
  • GHSA-h58c-xccx-75m3 — Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings
  • GHSA-5rw4-4665-cvwf — Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
  • GHSA-jm78-9fvv-mhgr — GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
  • EEF-CVE-2026-68747 — CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input
  • GHSA-9473-5f9j-94wq — Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
  • GHSA-v3r7-h72x-cjcm — undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
  • GHSA-3rp5-jjmw-4wv2 — GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
  • GHSA-mcqq-fqgf-rxwm — Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
  • GHSA-pwpj-p52h-q484 — Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
  • GHSA-xhf5-7wjv-pqxp — containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
  • GHSA-fqc7-9xjw-jrh3 — SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
  • GHSA-37m5-m4q3-fc6x — Froxlor: BIND Zone File Injection via TXT Record Content
  • GHSA-j6fm-9rfm-j5hx — Froxlor has an incomplete fix for CVE-2026-30932

All advisories for CWE-74

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor