Advisories · Weakness
CWE-693.
Every Advisory and CVE whose sources give the weakness CWE-693, newest first.
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 5.3 Medium
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
- HTTP request smuggling
- CWE-693
<4.12.21 · fixed in 4.12.21
GHSA-2gcr-mfcq-wcc3 · CVE-2026-47676 - CVSS 3.7 Low
HCL iControl was affected by Missing Security Headers vulnerability.
- HCL iControl
- CWE-693
- CVSS 8.0 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 5.3 Medium
Aider-AI Aider Pre-commit Hook args.py protection mechanism
- Aider
- CWE-693
- CVSS 8.6 High
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
- CWE-693
<3.11.4 · fixed in 3.11.4
GHSA-r9pm-gxmw-wv6p · CVE-2026-47139 - CVSS 10.0 CriticalCritical · CVSS 9+
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- CWE-693
<3.11.4 · fixed in 3.11.4
GHSA-rp36-8xq3-r6c4 · CVE-2026-47140 - CVSS 8.6 High
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
- CWE-693
<3.11.4 · fixed in 3.11.4
GHSA-c4cf-2hgv-2qv6 · CVE-2026-47209 - CVSS 8.7 High
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
- CWE-693
<3.11.4 · fixed in 3.11.4
GHSA-m5q2-4fm3-vfqp · CVE-2026-47135 - CVSS 2.1 Low
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
- CWE-693
<3.11.4 · fixed in 3.11.4
GHSA-q3fm-4wcw-g57x · CVE-2026-92962 - CVSS 4.1 Medium
Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown
- Indian Motorcycle Scout Bobber + Tech
- CWE-440
- CWE-693
- CVSS 4.1 Medium
Indian Scout Bobber 2025 WCM voltage-based shutdown
- Indian Motorcycle Scout Bobber + Tech
- CWE-693
- CWE-754
- CVSS 7.2 High
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
- CWE-693
>=1.5.0, <1.7.8 · fixed in 1.7.8
GHSA-rw47-hm26-6wr7 · CVE-2026-44982 - CVSS 4.4 Medium
pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution
- mcdope pam_usb
- CWE-390
- CWE-693
- CVSS 9.9 CriticalCritical · CVSS 9+
OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion
- oneuptime
- CWE-693
- CVSS 5.3 Medium
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
- CWE-693
<10.26.0 · fixed in 10.26.0
GHSA-9x9p-qf8f-mvjg · CVE-2026-44646 - CVSS 9.3 CriticalCritical · CVSS 9+
Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass
- prolix-oc Lumiverse
- CWE-693
- CVSS 7.1 High
Twig: Sandbox property and method bypass via object-destructuring assignment
- CWE-693
>=3.24.0, <3.26.0 · fixed in 3.26.0
GHSA-mm6w-gr99-p3jj · CVE-2026-46639 - CVSS 6.0 Medium
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- CWE-693
<3.26.0 · fixed in 3.26.0
GHSA-7fxw-r6jv-74c8 · CVE-2026-46638 - CVSS 7.7 High
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- CWE-693
>=3.9.0, <3.26.0 · fixed in 3.26.0
GHSA-24x9-r6q4-q93w · CVE-2026-46634 - CVSS 9.3 CriticalCritical · CVSS 9+
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
- CWE-693
<1.3.2 · fixed in 1.3.2
GHSA-59f3-7227-wmh4 · CVE-2026-82855 - CVSS 6.3 Medium
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
- CWE-693
<1.7.17 · fixed in 1.7.17
GHSA-jc6w-wmfc-fh33 · CVE-2026-46403 - CVSS 3.7 Low
FORTIFY_SOURCE disabled
- Netatalk
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 8.1 High
Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 8.1 High
Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-20
- CVSS 8.6 High
Information disclosure, sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-693
- CVSS 7.5 High
Sandbox escape in Firefox and Firefox Focus for Android
- Mozilla Firefox
- CWE-653
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Formie: Pre-authenticated server-side template injection in Hidden fields
- Code injection
- CWE-693
<2.2.20 || >=3.0.0-beta.1, <3.1.24 · fixed in 2.2.20, 3.1.24
GHSA-x7m9-mwc2-g6w2 · CVE-2026-45697 - CVSS 7.5 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 5.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 3.1 Low
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 8.3 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 5.3 Medium
Strapi Upload Plugin MIME Validation Bypass via Content API
- Unrestricted file upload
- CWE-693
<5.33.3 · fixed in 5.33.3
GHSA-pcw7-5633-82vv · CVE-2026-22707 - CVSS 1.8 Low
Protection mechanism failure in Zoom Communications Zoom Workplace
- Zoom Communications Zoom Workplace
- CWE-693
- CVSS 5.7 Medium
Protection mechanism failure in AMD EPYC™ Series 9004 Processors and others
- AMD EPYC™ Series 9004 Processors
- AMD EPYC™Series 4004 Processors
- CWE-693
- CVSS 8.7 High
Heym < 0.0.21 Sandbox Escape via Python Introspection
- heym
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Sandbox escape in the Profile Backup component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-653
- CWE-693
- CVSS 7.5 High
Protection mechanism failure in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- CWE-693
- CVSS 5.5 Medium
Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-358
- CWE-693
- CVSS 6.9 Medium
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
- CWE-227
- CWE-693
<3.11.2 · fixed in 3.11.2
GHSA-2cm2-m3w5-gp2f · CVE-2026-92963 - CVSS 7.1 High
PromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote`
- legeling PromptHub
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- Broken access control
- CWE-693
<3.11.1 · fixed in 3.11.1
GHSA-8hg8-63c5-gwmx · CVE-2026-44007 - CVSS 5.3 Medium
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
- CWE-693
<3.11.0 · fixed in 3.11.0
GHSA-wp5r-2gw5-m7q7 · CVE-2026-44003 - CVSS 6.5 Medium
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
- Information disclosure
- CWE-693
<3.11.0 · fixed in 3.11.0
GHSA-mpf8-4hx2-7cjg · CVE-2026-44000 - CVSS 8.7 High
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
- CWE-693
<2.56.0 · fixed in 2.56.0
GHSA-vrqv-52x7-rm4v · CVE-2026-80198 - CVSS 8.1 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 5.0 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693