Skip to content
OpenAdvisories

Weakness (CWE)

CWE-913: Improper Control of Dynamically-Managed Code Resources

Class Incomplete

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

How to prevent it (2 mitigations)

  1. Implementation

    For any externally-influenced input, check the input against an allowlist of acceptable values.

  2. Implementation, Architecture and Design

    Refactor the code so that it does not need to be dynamically managed.

Source: MITRE CWE-913

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-40217 Public exploit EPSS 17%

    LiteLLM has a sandbox escape in custom-code guardrail

    LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

    BerriAI litellm litellm PyPI
  • High 8.8
    CVE-2025-69219 Public exploit

    Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

    A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the like…

    Apache Software Foundation Apache Airflow Providers Http apache-airflow-providers-http PyPI
  • High 7.3
    CVE-2025-6384 Public exploit

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restr…

    CrafterCMS CrafterCMS org.craftercms:crafter-studio Maven
  • High 8.8
    CVE-2023-50386 Public exploit EPSS 84%

    Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

    Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Maven
  • High 8.0
    CVE-2021-21413 Public exploit

    Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate

    isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isol…

    laverdet isolated-vm isolated-vm npm