cve.bz

CWE-153: Improper Neutralization of Substitution Characters

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.

What the weakness is: CWE-153 at MITRE. All weaknesses

Ask an AI about CWE-153

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-153: Improper Neutralization of Substitution Characters and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/153.html and https://cve.bz/cve/cwe/153?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-9694EPSS 0.2%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLa…

  2. 8.9CVE-2025-53006EPSS 0.6%

    DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "ss…

  3. 8.9CVE-2025-53005EPSS 0.6%

    DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's PostgreSQL Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg param…

  4. 8.9CVE-2025-53004EPSS 0.6%

    DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg paramet…

  5. 8.9CVE-2025-49003EPSS 0.9%

    DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the char…