Weakness (CWE)
CWE-914: Improper Control of Dynamically-Identified Variables
Base Incomplete
The product does not properly restrict reading from or writing to dynamically-identified variables.
How to prevent it (2 mitigations)
-
Implementation
For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
-
Implementation, Architecture and Design
Refactor the code so that internal program variables do not need to be dynamically identified.
Source: MITRE CWE-914
1 result · Clear filters · Feed
-
High 7.9CVE-2026-34444 Public exploit
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended rest…