Skip to content
OpenAdvisories

Weakness (CWE)

CWE-471: Modification of Assumed-Immutable Data (MAID)

Base Draft

The product does not properly protect an assumed-immutable element from being modified by an attacker.

How to prevent it (1 mitigation)

  1. Architecture and Design, Operation, Implementation

    When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.

Source: MITRE CWE-471

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-7808

    justhtml before 1.16.0 Multiple Security Issues via Sanitization

    justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather th…

    EmilStenstrom justhtml justhtml PyPI
  • Critical 9.9
    CVE-2026-50481

    Azure Active Directory Elevation of Privilege Vulnerability

    Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Active Directory
  • Critical 9.8
    CVE-2022-25893

    Arbitrary Code Execution

    The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

    vm2 npm
  • Critical 9.8
    CVE-2020-8158 Public exploit

    TypeORM vulnerable to MAID and Prototype Pollution

    Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

    typeorm npm