cve.bz

CWE-154: Improper Neutralization of Variable Name Delimiters

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component, such as a "$" that could be used to access an environment variable.

What the weakness is: CWE-154 at MITRE. All weaknesses

Related attack patterns (CAPEC): 1
  • CAPEC-15 Command Delimiters Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-154, as MITRE names them. Credits.

Ask an AI about CWE-154

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-154: Improper Neutralization of Variable Name Delimiters and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/154.html and https://cve.bz/cve/cwe/154?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-39698EPSS 0.4%

    electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because o…