Skip to content
OpenAdvisories

Weakness (CWE)

CWE-914: Improper Control of Dynamically-Identified Variables

Base Incomplete

The product does not properly restrict reading from or writing to dynamically-identified variables.

How to prevent it (2 mitigations)

  1. Implementation

    For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.

  2. Implementation, Architecture and Design

    Refactor the code so that internal program variables do not need to be dynamically identified.

Source: MITRE CWE-914

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-44006

    vm2: Sandbox Escape

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

    patriksimek vm2 vm2 npm
  • Critical 9.1
    CVE-2023-33175

    ToUI allows user-specific variables to be shared between users

    ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has …

    mubarakalmehairbi ToUI toui PyPI