Improper Neutralization of Equivalent Special Elements
CWE-76
The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous -e command-line switch when calling an external program, but it might not account for --exec or other switches that have the same semantics.
We track 10 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.
Latest Improper Neutralization of Equivalent Special Elements vulnerabilities
- 8.8 High severity
NGINX Gateway Fabric: Improper Neutralization of Equivalent Special Elements
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A nam
- 8.3 High severity
NGINX Ingress Controller: Improper Neutralization of Equivalent Special Elements
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without san
- 8.1 High severity
NGINX Gateway Fabric: Improper Neutralization of Equivalent Special Elements
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom R
- 8.7 High severity
dssrf-js: Improper Neutralization of Equivalent Special Elements
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attack
- 8.3 High severity
NGINX Ingress Controller: Improper Neutralization of Equivalent Special Elements
When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the gen
- 9.8 Critical severity
simple-git: Improper Neutralization of Special Elements used in an OS Command
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on t
- 8.4 High severity
parisneo/lollms-webui: Improper Neutralization of Equivalent Special Elements
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'b
- 9.6 Critical severity
llama-cpp-python: Improper Neutralization of Equivalent Special Elements
llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure
- 9.8 Critical severity
berriai/litellm: Improper Neutralization of Equivalent Special Elements
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja
- 7.2 High severity
PaperCut NG, PaperCut MF: Improper Neutralization of Equivalent Special Elements
This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.