CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Class

The product does not adequately filter user-controlled input for special elements with control implications.

Consequences

Integrity, Confidentiality, Availability: Modify Application Data, Execute Unauthorized Code or Commands

How to prevent it

Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

Recent advisories

GHSA-64f8-pjgr-9wmr — Untrusted Query Object Evaluation in RPC API
GHSA-cvg2-7c3j-g36j — Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
GHSA-3j93-7rf7-p7m6 — thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter
GHSA-83pm-7v48-5jp4 — rdiffweb vulnerable to Special Element Injection
GHSA-rj5f-vm79-5j84 — OctoPrint vulnerable to Special Element Injection

All advisories for CWE-75

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor