{"@ID": "356", "@Name": "Missing User Interaction for Potentially Unsafe Action", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product encounters a situation in which some\n         of its behavior is security-critical and should be authorized\n         by a human before progressing, but it does not properly\n         consult with the human user or its proxy (such as UI approval\n         dialogues or pre-set policies) to determine whether it is\n         allowed to perform the potentially dangerous\n         behavior.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "285", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "PeerOf", "@CWE_ID": "451", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": [{"@Name": "AI/ML", "@Prevalence": "Undetermined"}, {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}]}, "Alternate_Terms": {"Alternate_Term": [{"Term": "Human-in-the-Loop", "Description": "Used in various applications, especially for\n\t     AI/ML applications, to indicate situations in which the\n\t     human user must be consulted before determining the next\n\t     action to take."}, {"Term": "HITL", "Role": "Acronym", "Description": "Acronym for \"Human-in-the-Loop\""}]}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design", "Note": "The architecture or design might include a\n\t      component or potentially dangerous functionality that\n\t      could effectively act independently."}, {"Phase": "Implementation", "Note": "A bug in the implementation could cause the product\n\t\t to fail to recognize that it is about to perform a\n\t\t dangerous operation requiring a human decision."}]}, "Common_Consequences": {"Consequence": {"Scope": "Non-Repudiation", "Impact": "Hide Activities", "Note": "This makes it easier for attackers to trick users into inflicting damage to their system."}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Architecture and Design", "Description": "Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe."}}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2000-0788", "Description": "Document editor runs macros without asking for user approval.", "Link": "https://www.cve.org/CVERecord?id=CVE-2000-0788"}, {"Reference": "CVE-2003-0660", "Description": "OS does not prompt the user to download and install\n\t     ActiveX controls when the system is low on memory.", "Link": "https://www.cve.org/CVERecord?id=CVE-2003-0660"}, {"Reference": "CVE-2008-2540", "Description": "Chain: Web browser does not prompt the user\n\t     before downloading an object that has an unrecognized\n\t     content type (CWE-356), leading to untrusted search path\n\t     (CWE-426) on a different OS.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2540"}, {"Reference": "CVE-2026-10591", "Description": "AI agentic IDE product for cloud service\n\t     does not consult the \"Human-in-the-Loop\" (HITL) in some\n\t     security-critical decisions, allowing rewrite of its own\n\t     Model Context Protocol (MCP), leading to configuration\n\t     change and code execution [REF-1582].", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-10591"}, {"Reference": "CVE-2026-33068", "Description": "AI agentic coding tool trusts a\n\t     potentially-untrusted configuration input, causing it to\n\t     skip a \"trust confirmation dialog\" before conducting\n\t     potentially dangerous actions.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-33068"}, {"Reference": "CVE-2025-59828", "Description": "Chain: AI agentic coding tool auto-executes\n\t     Yarn plugins in untrusted directories (CWE-696) before\n\t     asking the user to approve the action (CWE-356).", "Link": "https://www.cve.org/CVERecord?id=CVE-2025-59828", "Rationale": "Chain"}, {"Reference": "CVE-1999-1055", "Description": "Product does not warn user when document contains certain dangerous functions or macros.", "Link": "https://www.cve.org/CVERecord?id=CVE-1999-1055", "Rationale": "Early-Publication"}, {"Reference": "CVE-1999-0794", "Description": "Product does not warn user when document contains certain dangerous functions or macros.", "Link": "https://www.cve.org/CVERecord?id=CVE-1999-0794"}, {"Reference": "CVE-2000-0277", "Description": "Product does not warn user when document contains certain dangerous functions or macros.", "Link": "https://www.cve.org/CVERecord?id=CVE-2000-0277"}, {"Reference": "CVE-2000-0517", "Description": "Product does not warn user about a certificate if it has already been accepted for a different site. Possibly resultant.", "Link": "https://www.cve.org/CVERecord?id=CVE-2000-0517"}, {"Reference": "CVE-2005-0602", "Description": "File extractor does not warn user if setuid/setgid files could be extracted. Overlaps privileges/permissions.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-0602"}, {"Reference": "CVE-2000-0342", "Description": "Chain: E-mail client allows bypass of warning for dangerous attachments (CWE-356) via a Windows .LNK file that refers to the attachment (CWE-64).", "Link": "https://www.cve.org/CVERecord?id=CVE-2000-0342"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "PLOVER", "Entry_Name": "Product UI does not warn user of unsafe actions"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-1582"}, {"@External_Reference_ID": "REF-1583"}, {"@External_Reference_ID": "REF-1584"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": [{"@Type": "Relationship", "#text": "Often resultant, e.g. in unhandled error conditions."}, {"@Type": "Relationship", "#text": "Can overlap privilege errors, conceptually at least."}]}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships, Relationship_Notes, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-10-14", "Modification_Version": "1.0.1", "Modification_ReleaseDate": "2008-10-14", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Applicable_Platforms"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, References, Relationships"}], "Contribution": {"@Type": "Feedback", "Contribution_Name": "Eran Segal", "Contribution_Date": "2025-12-24", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Suggested improved coverage of Human-in-the-Loop bypasses in AI systems, leading to updates to this entry."}, "Previous_Entry_Name": {"@Date": "2026-10-28", "#text": "Product UI does not Warn User of Unsafe Actions"}}, "entry_type": "Weakness"}