cve.bz

CWE-494: Download of Code Without Integrity Check

Filter

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

What the weakness is: CWE-494 at MITRE

Related attack patterns (CAPEC): 12
  • CAPEC-184 Software Integrity Attack Severity: Low
  • CAPEC-185 Malicious Software Download Severity: Very High
  • CAPEC-186 Malicious Software Update Severity: High
  • CAPEC-187 Malicious Automated Software Update via Redirection Likelihood: High · Severity: High
  • CAPEC-533 Malicious Manual Software Update Likelihood: Low · Severity: High
  • CAPEC-538 Open-Source Library Manipulation Likelihood: Low · Severity: High
  • CAPEC-657 Malicious Automated Software Update via Spoofing Likelihood: High · Severity: High
  • CAPEC-662 Adversary in the Browser (AiTB) Likelihood: High · Severity: Very High
  • CAPEC-691 Spoof Open-Source Software Metadata Likelihood: Medium · Severity: High
  • CAPEC-692 Spoof Version Control System Commit Metadata Likelihood: Medium · Severity: High
  • CAPEC-693 StarJacking Likelihood: Medium · Severity: High
  • CAPEC-695 Repo Jacking Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-494, as MITRE names them. Credits.

Ask an AI about CWE-494

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-494: Download of Code Without Integrity Check and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/494.html and https://cve.bz/cve/cwe/494?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.6CVE-2026-110022

    The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the …

  2. 7.4CVE-2026-92092EPSS 0.2%

    A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or…

  3. 9.6CVE-2026-55981EPSS 0.2%

    A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.

  4. 2.3CVE-2026-113717EPSS 0.3%

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured …

  5. 7.5CVE-2026-105036EPSS 0.2%

    EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacke…

  6. 7.5CVE-2026-93649EPSS 0.2%

    In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query p…

  7. 7.5CVE-2026-86063EPSS 0.2%

    Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character…

  8. 7.7CVE-2026-110102EPSS 0.1%

    Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned …

  9. 7.7CVE-2026-108160EPSS 0.1%

    AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the cl…

  10. 7.5CVE-2026-107812EPSS 0.2%

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or netwo…

  11. 8.4CVE-2026-29797EPSS 0.2%

    No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware wit…

  12. 8.4CVE-2026-104809EPSS 0.10%

    DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without a…

  13. 8.5CVE-2026-104805EPSS 0.2%

    DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific …

  14. 7.7CVE-2026-105295EPSS 0.1%

    GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an …

  15. 1.3CVE-2026-105137EPSS 0.1%

    A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be laun…

  16. 6.5CVE-2026-55251EPSS 0.1%

    NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pull_request and executes code supplied by th…

  17. 6.5CVE-2026-100265EPSS 0.1%

    In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

  18. 7.7CVE-2026-102930EPSS 0.2%

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an…

  19. 9.8CVE-2026-73595EPSS 0.1%

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exp…

  20. 8.8CVE-2026-96455EPSS 0.3%

    The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_man…

  21. 7.1CVE-2026-49450EPSS 0.2%

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.ym…

  22. 5.3CVE-2026-93534EPSS 0.2%

    A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without int…

  23. 7.0CVE-2026-7006EPSS 0.1%

    Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by…

  24. 7.5CVE-2026-92128EPSS 0.3%

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to defin…

  25. 9.1CVE-2026-63696EPSS 0.3%

    Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code exec…

  26. 6.8CVE-2026-81052EPSS 0.2%

    Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code exec…

  27. 7.4CVE-2026-79963EPSS 0.3%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentia…

  28. 7.0CVE-2026-62654EPSS 0.2%

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network…

  29. 9.2CVE-2026-85427EPSS 0.6%

    MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish…

  30. 5.4CVE-2026-84666EPSS 0.1%

    Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified…

  31. 5.4CVE-2026-84664EPSS 0.1%

    Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by a…

  32. 7.8CVE-2026-80047EPSS 0.10%

    A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and cach…

  33. 9.0CVE-2026-82021EPSS 0.3%

    Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch …

  34. 8.1CVE-2026-59286EPSS 0.3%

    The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading …

  35. 9.8CVE-2026-30612EPSS 0.4%

    An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS compone…

  36. 4.4CVE-2026-21810EPSS 0.1%

    HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.

  37. 8.8CVE-2026-65097EPSS 0.3%

    NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check. A successful exploit of this vulnerability might lead to code execution, escalation o…

  38. 9.8CVE-2026-65081EPSS 0.4%

    NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, d…

  39. 9.3CVE-2026-57910EPSS 0.2%

    Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

  40. 10.0CVE-2026-22306EPSS 0.2%

    Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update doma…

  41. 7.3CVE-2026-76241EPSS 0.1%

    stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-…

  42. 7.5CVE-2026-53970EPSS 0.3%

    ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-ba…

  43. 9.6CVE-2026-13433EPSS 0.2%

    IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's wo…

  44. 9.3CVE-2026-48046EPSS 0.4%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process dow…

  45. 7.3CVE-2026-0392EPSS 0.09%

    eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS bu…

  46. 6.5CVE-2026-12259EPSS 0.1%

    In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with t…

  47. 9.4CVE-2026-66398EPSS 0.4%

    phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the …

  48. 9.3CVE-2026-50562EPSS 0.2%

    FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/previe…

  49. 7.7CVE-2021-47987EPSS 0.2%

    Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were publishe…

  50. 7.7CVE-2021-47986EPSS 0.2%

    Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in …