CWE-783: Operator Precedence Logic Error

BaseLikelihood of exploit: Low

The product uses an expression in which operator precedence causes incorrect logic to be used.

While often just a bug, operator precedence logic errors can have serious consequences if they are used in security-critical code, such as making an authentication decision.

Consequences

Confidentiality, Integrity, Availability: Varies by Context, Unexpected State

How to prevent it

Implementation: Regularly wrap sub-expressions in parentheses, especially in security-critical code.

Recent advisories

GHSA-39q2-94rc-95cp — DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
CVE-2024-32896 — there is a possible way to bypass due to a logic error in the code.

All advisories for CWE-783

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor