Common Weakness Enumeration
CWE-117
Weakness AllowedImproper Output Neutralization for Logs
Abstraction: Base · Status: Draft
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Submission: 7 Pernicious Kingdoms
· 2006-07-19
· CWE Draft 3
Contribution: Affan Ahmed
· 2025-02-28
· CWE 5.0
Provided a PHP-based demonstrative example
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated References, Potential_Mitigations, Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Relationships, Other_Notes, References, Taxonomy_Mappings, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2008-11-24
· CWE 1.1
updated Background_Details, Common_Consequences, Description, Other_Notes, References
Modification: CWE Content Team
· MITRE
· 2009-03-10
· CWE 1.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Demonstrative_Examples, Description, Name, Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2009-07-27
· CWE 1.5
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2009-10-29
· CWE 1.6
updated Common_Consequences, Other_Notes, Relationships
Modification: CWE Content Team
· MITRE
· 2010-06-21
· CWE 1.9
updated Description, Name
Modification: CWE Content Team
· MITRE
· 2010-12-13
· CWE 1.11
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2011-03-29
· CWE 1.12
updated Description, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Common_Consequences, Relationships
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2017-05-03
· CWE 2.11
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Causal_Nature, Modes_of_Introduction, References, Relationships
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Potential_Mitigations, References, Relationships
Modification: CWE Content Team
· MITRE
· 2020-06-25
· CWE 4.1
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-04-03
· CWE 4.17
updated Alternate_Terms, Description, Diagram
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Relationships
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships, Taxonomy_Mappings
274 vulnerabilities reference this CWE, most recent first.
CVE-2026-125125 (GCVE-0-2026-125125)
Vulnerability from cvelistv5 – Published: 2026-11-10 16:55 – Updated: 2026-11-10 19:04
VLAI
EPSS
VEX
Title
compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message
Summary
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 18:19 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tmatens/compose-lint/security/… | x_refsource_CONFIRM |
| https://github.com/tmatens/compose-lint/pull/945 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/commit/54… | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tmatens | compose-lint |
Affected:
>= 0.30.0, < 0.32.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125125",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T18:19:14.192887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:04:15.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compose-lint",
"vendor": "tmatens",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.30.0, \u003c 0.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:55:55.117Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"
},
{
"name": "https://github.com/tmatens/compose-lint/pull/945",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/pull/945"
},
{
"name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
},
{
"name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
}
],
"source": {
"advisory": "GHSA-xcf7-88g6-7xr8",
"discovery": "UNKNOWN"
},
"title": "compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action\u0027s SARIF-directory error message"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125125",
"datePublished": "2026-11-10T16:55:55.117Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-10T19:04:15.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125124 (GCVE-0-2026-125124)
Vulnerability from cvelistv5 – Published: 2026-11-10 16:53 – Updated: 2026-11-14 02:56
VLAI
EPSS
VEX
Title
compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0's output
Summary
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-14 02:56 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tmatens/compose-lint/security/… | x_refsource_CONFIRM |
| https://github.com/tmatens/compose-lint/pull/945 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/commit/54… | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tmatens | compose-lint |
Affected:
= 0.31.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125124",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-14T02:56:38.967239Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T02:56:58.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compose-lint",
"vendor": "tmatens",
"versions": [
{
"status": "affected",
"version": "= 0.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:53:57.148Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv"
},
{
"name": "https://github.com/tmatens/compose-lint/pull/945",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/pull/945"
},
{
"name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
},
{
"name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
}
],
"source": {
"advisory": "GHSA-m4xg-839g-24cv",
"discovery": "UNKNOWN"
},
"title": "compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0\u0027s output"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125124",
"datePublished": "2026-11-10T16:53:57.148Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-14T02:56:58.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125123 (GCVE-0-2026-125123)
Vulnerability from cvelistv5 – Published: 2026-11-10 16:52 – Updated: 2026-11-10 21:06
VLAI
EPSS
VEX
Title
compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages
Summary
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:06 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tmatens/compose-lint/security/… | x_refsource_CONFIRM |
| https://github.com/tmatens/compose-lint/pull/945 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/commit/54… | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tmatens | compose-lint |
Affected:
= 0.31.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T21:06:15.458993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T21:06:30.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compose-lint",
"vendor": "tmatens",
"versions": [
{
"status": "affected",
"version": "= 0.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint\u0027s argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:52:31.891Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"
},
{
"name": "https://github.com/tmatens/compose-lint/pull/945",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/pull/945"
},
{
"name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
},
{
"name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
}
],
"source": {
"advisory": "GHSA-8v59-qmwv-4p6q",
"discovery": "UNKNOWN"
},
"title": "compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0\u0027s command-line error messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125123",
"datePublished": "2026-11-10T16:52:31.891Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-10T21:06:30.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125122 (GCVE-0-2026-125122)
Vulnerability from cvelistv5 – Published: 2026-11-10 16:50 – Updated: 2026-11-13 15:25
VLAI
EPSS
VEX
Title
compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout
Summary
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:25 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tmatens/compose-lint/security/… | x_refsource_CONFIRM |
| https://github.com/tmatens/compose-lint/pull/945 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/commit/54… | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tmatens | compose-lint |
Affected:
= 0.31.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:25:03.488776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:25:23.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compose-lint",
"vendor": "tmatens",
"versions": [
{
"status": "affected",
"version": "= 0.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:50:46.826Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"
},
{
"name": "https://github.com/tmatens/compose-lint/pull/945",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/pull/945"
},
{
"name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
},
{
"name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
}
],
"source": {
"advisory": "GHSA-hr4h-4c45-v4q4",
"discovery": "UNKNOWN"
},
"title": "compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0\u0027s JSON and SARIF output on stdout"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125122",
"datePublished": "2026-11-10T16:50:46.826Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-13T15:25:23.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125121 (GCVE-0-2026-125121)
Vulnerability from cvelistv5 – Published: 2026-11-10 16:43 – Updated: 2026-11-12 18:02
VLAI
EPSS
VEX
Title
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
Summary
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:37 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tmatens/compose-lint/security/… | x_refsource_CONFIRM |
| https://github.com/tmatens/compose-lint/pull/945 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/commit/54… | x_refsource_MISC |
| https://github.com/advisories/GHSA-6f4g-xm8v-pgv6 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tmatens | compose-lint |
Affected:
>= 0.31.0, < 0.32.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:37:51.109387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:02:58.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compose-lint",
"vendor": "tmatens",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.31.0, \u003c 0.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:50:03.051Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"
},
{
"name": "https://github.com/tmatens/compose-lint/pull/945",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/pull/945"
},
{
"name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
},
{
"name": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6"
},
{
"name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
}
],
"source": {
"advisory": "GHSA-r7j4-crjv-h467",
"discovery": "UNKNOWN"
},
"title": "compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0\u0027s output"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125121",
"datePublished": "2026-11-10T16:43:01.275Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-12T18:02:58.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123369 (GCVE-0-2026-123369)
Vulnerability from cvelistv5 – Published: 2026-11-09 17:32 – Updated: 2026-11-09 22:55
VLAI
EPSS
VEX
Title
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
Summary
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:52 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tmatens/compose-lint/security/… | x_refsource_CONFIRM |
| https://github.com/tmatens/compose-lint/pull/918 | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/commit/67… | x_refsource_MISC |
| https://github.com/tmatens/compose-lint/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tmatens | compose-lint |
Affected:
< 0.31.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:52:06.368275Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:55:25.407Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compose-lint",
"vendor": "tmatens",
"versions": [
{
"status": "affected",
"version": "\u003c 0.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:32:25.031Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"
},
{
"name": "https://github.com/tmatens/compose-lint/pull/918",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/pull/918"
},
{
"name": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"
},
{
"name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
}
],
"source": {
"advisory": "GHSA-6f4g-xm8v-pgv6",
"discovery": "UNKNOWN"
},
"title": "compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123369",
"datePublished": "2026-11-09T17:32:25.031Z",
"dateReserved": "2026-11-05T20:43:10.420Z",
"dateUpdated": "2026-11-09T22:55:25.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119423 (GCVE-0-2026-119423)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-04 15:05
VLAI
EPSS
VEX
Title
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
Summary
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 15:05 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/14f8f7dd1… | patch |
| https://github.com/opnsense/core/commit/2076f2c19… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://abraxaslabs.tech/research/opnsense-lockou… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T15:05:24.381582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:05:35.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like \u0027Invalid user \u003cvictim-ip\u003e\u0027 repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:53.650Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70"
},
{
"name": "GitHub Security Advisory (GHSA-2v2x-m4j7-76pv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-lockout-factory-ip"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username"
}
],
"title": "OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119423",
"datePublished": "2026-10-30T11:30:53.650Z",
"dateReserved": "2026-10-30T02:41:13.241Z",
"dateUpdated": "2026-11-04T15:05:35.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118994 (GCVE-0-2026-118994)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:10 – Updated: 2026-11-06 16:51
VLAI
EPSS
VEX
Title
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
Summary
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.
login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.
An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:51 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:51:11.114526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:51:32.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"CallBackery"
],
"packageName": "CallBackery",
"packageURL": "pkg:cpan/CallBackery",
"programFiles": [
"lib/CallBackery/User.pm"
],
"programRoutines": [
{
"name": "CallBackery::User::login"
}
],
"repo": "https://github.com/oetiker/callbackery",
"versions": [
{
"lessThan": "0.62.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.\n\nlogin() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.\n\nAn unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117 Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:10:57.452Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to CallBackery 0.62.0 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-118994",
"datePublished": "2026-10-30T13:10:57.452Z",
"dateReserved": "2026-10-29T10:58:47.286Z",
"dateUpdated": "2026-11-06T16:51:32.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115788 (GCVE-0-2026-115788)
Vulnerability from cvelistv5 – Published: 2026-11-13 22:01 – Updated: 2026-11-13 22:01
VLAI
EPSS
VEX
Title
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Log Forging
Summary
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.
Severity
8.1 (High)
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7296008 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | App Connect Operator |
Affected:
12.1.0 , ≤ 12.21.0
(semver)
Affected: 12.0.0 , ≤ 12.0.28 (semver) Affected: 13.0.0 , ≤ 13.6.0 (semver) cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:* |
|
| IBM | App Connect Enterprise Certified Containers Operands |
Affected:
12.0.11.1-r1 , ≤ 12.0.12.5-r1
(custom)
Affected: 13.0.1.0-r1 , ≤ 13.0.6.2-r1 (custom) Affected: 12.0.12-r1 , ≤ 12.0.12-r28 (custom) Affected: 13.0.7.0-r1 , ≤ 13.0.9.0-r1 (custom) cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:* cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"
],
"product": "App Connect Operator",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "12.21.0",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.28",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.6.0",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"
],
"product": "App Connect Enterprise Certified Containers Operands",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "12.0.12.5-r1",
"status": "affected",
"version": "12.0.11.1-r1",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.6.2-r1",
"status": "affected",
"version": "13.0.1.0-r1",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.0.12-r28",
"status": "affected",
"version": "12.0.12-r1",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.9.0-r1",
"status": "affected",
"version": "13.0.7.0-r1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.\u003c/p\u003e"
}
],
"value": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117 Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T22:01:07.122Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7296008"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly suggests the following:\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. \u00a0Documentation on the upgrade process is available at \u003ca href=\"https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\" rel=\"nofollow\"\u003ehttps://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cbr/\u003e\u003cstrong\u003eApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. \u00a0Documentation on the upgrade process is available at \u003ca href=\"https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\" rel=\"nofollow\"\u003ehttps://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly suggests the following:\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases"
}
],
"title": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Log Forging"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-115788",
"datePublished": "2026-11-13T22:01:07.122Z",
"dateReserved": "2026-10-23T13:52:20.386Z",
"dateUpdated": "2026-11-13T22:01:07.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111211 (GCVE-0-2026-111211)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:41 – Updated: 2026-11-03 17:50
VLAI
EPSS
VEX
Title
Potential log injection via unescaped geometry form values
Summary
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:50 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| djangoproject | Django |
Affected:
6.1 , < 6.1.3
(python)
Unaffected: 6.1.3 (python) Affected: 6.0 , < 6.0.10 (python) Unaffected: 6.0.10 (python) Affected: 5.2 , < 5.2.19 (python) Unaffected: 5.2.19 (python) |
Date Public
2026-11-03 09:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111211",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:50:24.327532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:50:48.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/Django/",
"defaultStatus": "unaffected",
"packageName": "django",
"product": "Django",
"repo": "https://github.com/django/django/",
"vendor": "djangoproject",
"versions": [
{
"lessThan": "6.1.3",
"status": "affected",
"version": "6.1",
"versionType": "python"
},
{
"status": "unaffected",
"version": "6.1.3",
"versionType": "python"
},
{
"lessThan": "6.0.10",
"status": "affected",
"version": "6.0",
"versionType": "python"
},
{
"status": "unaffected",
"version": "6.0.10",
"versionType": "python"
},
{
"lessThan": "5.2.19",
"status": "affected",
"version": "5.2",
"versionType": "python"
},
{
"status": "unaffected",
"version": "5.2.19",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aaron chen"
},
{
"lang": "en",
"type": "analyst",
"value": "David Smith"
},
{
"lang": "en",
"type": "analyst",
"value": "Jake Howard"
},
{
"lang": "en",
"type": "analyst",
"value": "Jacob Walls"
},
{
"lang": "en",
"type": "analyst",
"value": "Natalia Bidart"
},
{
"lang": "en",
"type": "remediation developer",
"value": "David Smith"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jacob Walls"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Natalia Bidart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Shai Berger"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jacob Walls"
}
],
"datePublic": "2026-11-03T09:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\u003c/p\u003e\u003cp\u003e\u003ccode\u003edjango.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()\u003c/code\u003e, used by \u003ccode\u003edjango.contrib.gis.forms.GeometryField\u003c/code\u003e, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Aaron chen for reporting this issue.\u003c/p\u003e"
}
],
"value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93: Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
"value": "low"
},
"type": "Django severity rating"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:41:58.889Z",
"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
"shortName": "DSF"
},
"references": [
{
"name": "Django security archive",
"tags": [
"vendor-advisory"
],
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"name": "Django releases announcements",
"tags": [
"mailing-list"
],
"url": "https://groups.google.com/g/django-announce"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a"
},
{
"name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19",
"tags": [
"vendor-advisory"
],
"url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "Initial report received."
},
{
"lang": "en",
"time": "2026-10-15T12:00:00.000Z",
"value": "Vulnerability confirmed."
},
{
"lang": "en",
"time": "2026-11-03T09:30:00.000Z",
"value": "Security release issued."
}
],
"title": "Potential log injection via unescaped geometry form values",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
"assignerShortName": "DSF",
"cveId": "CVE-2026-111211",
"datePublished": "2026-11-03T15:41:58.889Z",
"dateReserved": "2026-10-15T18:11:48.987Z",
"dateUpdated": "2026-11-03T17:50:48.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-30
Implementation
Strategy: Output Encoding
Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are inconsistent, the downstream component might treat some character or byte sequences as special, even if they are not special in the original encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks; they even might be able to bypass protection mechanisms that assume the original encoding is also being used by the downstream component.
Mitigation MIT-20
Implementation
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CAPEC-268: Audit Log Manipulation
The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.
CAPEC-93: Log Injection-Tampering-Forging
This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.