Reliance on Insufficiently Trustworthy Component
CWE-1357
The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Requirements Architecture and Design Implementation: Regardless of the source, each component should be sufficiently trusted to ensure correct, secure operation of the product. For each component, ensure that its supply chain is well-controlled with sub-tier suppliers using best practices. For third-party software components such as libraries, ensure that they are developed and actively maintained by reputable vendors.
- Architecture and Design Implementation Integration Manufacturing: Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to, An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships.
- Operation Patching and Maintenance: Continue to monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, supplier practices that affect trustworthiness, etc.
Latest Reliance on Insufficiently Trustworthy Component vulnerabilities
- 10.0 Critical severity
docs: Improper Control of Generation of Code
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearin
- 8.0 High severity
Red Hat Quay 3: Reliance on Insufficiently Trustworthy Component
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, lea
- 7.7 High severity
multicluster engine for Kubernetes 2.10: Reliance on Insufficiently Trustworthy Component
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remot
- 8.1 High severity
Dynamo: Reliance on Insufficiently Trustworthy Component
NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
- 9.8 Critical severity
conda-build: Reliance on Insufficiently Trustworthy Component
Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious