cve.bz

CWE-829: Inclusion of Functionality from Untrusted Control Sphere, page 3

Filter

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

What the weakness is: CWE-829 at MITRE

Related attack patterns (CAPEC): 13
  • CAPEC-175 Code Inclusion Likelihood: Medium · Severity: Very High
  • CAPEC-201 Serialized Data External Linking Likelihood: High · Severity: High
  • CAPEC-228 DTD Injection Severity: Medium
  • CAPEC-251 Local Code Inclusion Severity: Medium
  • CAPEC-252 PHP Local File Inclusion Severity: Medium
  • CAPEC-253 Remote Code Inclusion
  • CAPEC-263 Force Use of Corrupted Files Severity: Medium
  • CAPEC-538 Open-Source Library Manipulation Likelihood: Low · Severity: High
  • CAPEC-549 Local Execution of Code Likelihood: Medium · Severity: High
  • CAPEC-640 Inclusion of Code in Existing Process Likelihood: Low · Severity: High
  • CAPEC-660 Root/Jailbreak Detection Evasion via Hooking Likelihood: Medium · Severity: Very High
  • CAPEC-695 Repo Jacking Likelihood: Medium · Severity: High
  • CAPEC-698 Install Malicious Extension Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-829, as MITRE names them. Credits.

Ask an AI about CWE-829

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-829: Inclusion of Functionality from Untrusted Control Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/829.html and https://cve.bz/cve/cwe/829?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-59867EPSS 2.4%

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an atta…

  2. 9.3CVE-2026-59865EPSS 4.4%

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI descriptio…

  3. 9.3CVE-2026-59864EPSS 1.3%

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai…

  4. 9.3CVE-2026-50562EPSS 0.2%

    FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/previe…

  5. 8.6CVE-2026-40501EPSS 0.8%

    Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controll…

  6. 6.3CVE-2026-24226EPSS 0.2%

    NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  7. 8.8CVE-2026-57102EPSS 0.8%

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  8. 1.3CVE-2026-15519EPSS 0.3%

    A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control…

  9. 4.4CVE-2026-59831EPSS 0.3%

    GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process …

  10. 5.6CVE-2026-50195EPSS 0.3%

    containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's con…

  11. 9.3CVE-2026-58116EPSS 0.9%

    LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application pas…

  12. 9.6CVE-2026-13751EPSS 0.2%

    Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime wi…

  13. 8.8CVE-2026-55698EPSS 0.3%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDep…

  14. 8.8CVE-2026-55697EPSS 0.2%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependen…

  15. 8.8CVE-2026-55487EPSS 0.2%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a…

  16. 4.4CVE-2026-54325EPSS 0.2%

    Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, wh…

  17. 9.3CVE-2026-56447EPSS 0.6%

    MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled con…

  18. 8.4CVE-2026-46580EPSS 0.5%

    In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious reposi…

  19. 8.4CVE-2026-44691EPSS 0.4%

    In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, wh…

  20. 8.4CVE-2026-44688EPSS 0.5%

    In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository wi…

  21. 6.7CVE-2026-22551EPSS 0.3%

    In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an att…

  22. 7.5CVE-2026-22283EPSS 0.2%

    Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…

  23. 8.6CVE-2026-42089EPSS 0.2%

    Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names wi…

  24. 8.5CVE-2026-48124EPSS 0.1%

    Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious worksp…

  25. 7.8CVE-2026-12057EPSS 0.1%

    When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

  26. 7.7CVE-2026-53810EPSS 0.4%

    OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata…

  27. 7.3CVE-2026-52858EPSS 0.2%

    Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +pyth…

  28. 9.5CVE-2026-47174EPSS 0.4%

    In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment se…

  29. 9.5CVE-2026-47172EPSS 0.4%

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflo…

  30. 8.4CVE-2026-46529EPSS 0.5%

    Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code executio…

  31. 7.8CVE-2026-47292EPSS 0.4%

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

  32. 7.1CVE-2026-11269EPSS 0.1%

    Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity:…

  33. 7.5CVE-2026-8879EPSS 0.4%

    Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store s…

  34. 9.6CVE-2026-5241EPSS 0.6%

    A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_…

  35. 7.8CVE-2022-49042EPSS 0.1%

    An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.

  36. 7.8CVE-2022-49036EPSS 0.1%

    An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified…

  37. 8.2CVE-2026-44358EPSS 0.2%

    Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into…

  38. 8.8CVE-2026-5843EPSS 0.2%

    The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model…

  39. 8.8CVE-2026-5817EPSS 0.2%

    The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and…

  40. 7.5CVE-2026-8428EPSS 0.1%

    Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php never call…

  41. 7.5CVE-2026-8426EPSS 0.2%

    Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker who controls the remote package returned for a known marketplace item ID ca…

  42. 8.5CVE-2026-7373EPSS 0.2%

    Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which wo…

  43. 5.8CVE-2026-44312EPSS 0.1%

    css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The con…

  44. 9.3CVE-2026-44484EPSS 0.4%

    PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.

  45. 9.9CVE-2026-43999EPSS 1.0%

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads an…

  46. 5.4CVE-2026-44995EPSS 0.1%

    OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup v…

  47. 6.5CVE-2026-45184EPSS 0.1%

    Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.

  48. 9.4CVE-2026-44336EPSS 0.6%

    PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai…

  49. 9.4CVE-2026-43944EPSS 0.4%

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Expl…

  50. 8.4CVE-2026-43940EPSS 0.2%

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widg…