CWEweakness
CWE-501 Trust Boundary Violation
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific, Python
- CWE version
- 5.0
Description
The product mixes trusted and untrusted data in the same data structure or structured message.
Common consequences
• Access Control: Bypass Protection Mechanism
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Related
Child of · CWE (1)
- CWE-664 Improper Control of a Resource Through its Lifetime weakness
Peer of · CWE (1)
- CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data weakness
Referenced by CVE · weakness (35)
- CVE-2026-62146 A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved… vulnerability
- CVE-2026-102709 Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker… vulnerability
- CVE-2026-54248 Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. vulnerability
- CVE-2026-44091 An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the… vulnerability
- CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and… vulnerability
- CVE-2026-49458 DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. vulnerability
- CVE-2026-48746 vLLM is an inference and serving engine for large language models (LLMs). vulnerability
- CVE-2026-33828 Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally. vulnerability
- CVE-2026-35051 Traefik is an HTTP reverse proxy and load balancer. vulnerability
- CVE-2026-34780 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability
- CVE-2026-24153 NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. vulnerability
- CVE-2026-27893 vLLM is an inference and serving engine for large language models (LLMs). vulnerability
- CVE-2026-4687 Sandbox escape due to incorrect boundary conditions in the Telemetry component. vulnerability
- CVE-2026-25725 Claude Code is an agentic coding tool. vulnerability
- CVE-2025-14542 The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. vulnerability
- CVE-2025-64496 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. vulnerability
- CVE-2025-61884 Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). vulnerability
- CVE-2025-49714 Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally. vulnerability
- CVE-2025-48938 go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. vulnerability
- CVE-2025-1118 A flaw was found in grub2. vulnerability
- CVE-2024-49050 Visual Studio Code Python Extension Remote Code Execution Vulnerability vulnerability
- CVE-2024-3661 DHCP can add routes to a client’s routing table via the classless static route option (121). vulnerability
- CVE-2024-20265 A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the… vulnerability
- CVE-2024-1725 A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). vulnerability
- CVE-2024-23682 Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that… vulnerability
- CVE-2023-49788 Collabora Online is a collaborative online office suite based on LibreOffice technology. vulnerability
- CVE-2023-0627 Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation… vulnerability
- CVE-2023-28597 Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. vulnerability
- CVE-2023-0629 Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker… vulnerability
- CVE-2022-20826 A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance… vulnerability