cve.bz

CWE-829: Inclusion of Functionality from Untrusted Control Sphere, page 5

Filter

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

What the weakness is: CWE-829 at MITRE

Related attack patterns (CAPEC): 13
  • CAPEC-175 Code Inclusion Likelihood: Medium · Severity: Very High
  • CAPEC-201 Serialized Data External Linking Likelihood: High · Severity: High
  • CAPEC-228 DTD Injection Severity: Medium
  • CAPEC-251 Local Code Inclusion Severity: Medium
  • CAPEC-252 PHP Local File Inclusion Severity: Medium
  • CAPEC-253 Remote Code Inclusion
  • CAPEC-263 Force Use of Corrupted Files Severity: Medium
  • CAPEC-538 Open-Source Library Manipulation Likelihood: Low · Severity: High
  • CAPEC-549 Local Execution of Code Likelihood: Medium · Severity: High
  • CAPEC-640 Inclusion of Code in Existing Process Likelihood: Low · Severity: High
  • CAPEC-660 Root/Jailbreak Detection Evasion via Hooking Likelihood: Medium · Severity: Very High
  • CAPEC-695 Repo Jacking Likelihood: Medium · Severity: High
  • CAPEC-698 Install Malicious Extension Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-829, as MITRE names them. Credits.

Ask an AI about CWE-829

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-829: Inclusion of Functionality from Untrusted Control Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/829.html and https://cve.bz/cve/cwe/829?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2025-67842EPSS 0.4%

    The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

  2. 2.7CVE-2025-68162EPSS 0.2%

    In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration

  3. 8.1CVE-2025-67900EPSS 0.1%

    NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.

  4. 9.4CVE-2025-65964EPSS 0.7%

    n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git con…

  5. 7.8CVE-2025-53841EPSS 0.2%

    The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by a local privilege escalation vulnerability. The service will attempt to read an …

  6. 9.8CVE-2025-66022EPSS 0.7%

    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server…

  7. 7.3CVE-2025-33205EPSS 0.2%

    NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability …

  8. 8.7CVE-2024-32011EPSS 0.4%

    A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allo…

  9. 8.0CVE-2025-64496EPSS 7.2%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model ser…

  10. 8.4CVE-2025-12509EPSS 0.3%

    On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights.

  11. 8.8CVE-2025-62726EPSS 0.8%

    n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote re…

  12. 9.8CVE-2025-11023EPSS 0.6%

    Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP …

  13. 7.8CVE-2025-41390EPSS 0.3%

    An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to …

  14. 3.1CVE-2025-52655EPSS 0.2%

    Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data…

  15. 7.8CVE-2025-62186EPSS 0.1%

    Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.

  16. 8.5CVE-2025-36355EPSS 0.2%

    IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.

  17. 8.8CVE-2025-61592EPSS 0.5%

    Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current working directory (<project>/.cursor/cli.json) could override certain global configu…

  18. 7.7CVE-2025-59828EPSS 0.4%

    Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dial…

  19. 6.5CVE-2025-59535EPSS 0.4%

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even…

  20. 6.1CVE-2025-55305EPSS 0.3%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR I…

  21. 7.3CVE-2025-57729EPSS 0.1%

    In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

  22. 8.8CVE-2025-8714EPSS 0.8%

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-…

  23. 9.8CVE-2025-54135EPSS 2.1%

    Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if…

  24. 8.8CVE-2025-36727EPSS 0.5%

    Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12.

  25. 4.1CVE-2025-54558EPSS 0.2%

    OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.

  26. 7.6CVE-2025-27582EPSS 0.2%

    The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service …

  27. 9.1CVE-2025-53546EPSS 0.3%

    Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base…

  28. 7.8CVE-2025-49809EPSS 0.2%

    mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setui…

  29. 9.4CVE-2025-34074ExploitEPSS 2.2%

    An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job …

  30. 10.0CVE-2025-34060EPSS 0.8%

    A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to fi…

  31. 7.8CVE-2025-32463KEVExploitEPSS 56%

    Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

  32. 9.4CVE-2025-36852EPSS 0.2%

    A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor w…

  33. 8.8CVE-2025-39507EPSS 0.8%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through < 6.4.4.

  34. 7.8CVE-2024-52976EPSS 0.2%

    Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osque…

  35. 8.8CVE-2025-20236EPSS 1.0%

    A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the tar…

  36. 7.8CVE-2025-33027EPSS 0.3%

    In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required…

  37. 7.8CVE-2025-33026EPSS 0.3%

    In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit …

  38. 8.5CVE-2024-45482EPSS 0.1%

    An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.

  39. 8.8CVE-2025-27607EPSS 1.6%

    Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owne…

  40. 6.3CVE-2025-24796EPSS 0.5%

    Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within …

  41. 9.8CVE-2025-27668EPSS 0.7%

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Iframe OVE-20230524-0012.

  42. 9.3CVE-2025-27510EPSS 0.6%

    conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-m…

  43. 8.8CVE-2024-13353EPSS 0.7%

    The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.4 via several widgets. This makes it possible f…

  44. 3.8CVE-2024-31144EPSS 0.2%

    For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories (SRs)…

  45. 9.4CVE-2025-0982EPSS 0.3%

    Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application I…

  46. 9.8CVE-2024-49649EPSS 0.6%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from…

  47. 6.5CVE-2024-56216EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a…

  48. 7.5CVE-2024-54663EPSS 0.6%

    An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access…

  49. 8.4CVE-2024-48336EPSS 0.5%

    The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code i…

  50. 9.8CVE-2024-50497EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and Delivery Platform advanced-online-ordering-and-delivery-platform allows PHP Local …