CWEweakness

CWE-76 Improper Neutralization of Equivalent Special Elements

High Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Likelihood of exploit
High
Languages
Not Language-Specific
CWE version
5.0

Description

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

Extended description

The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous "-e" command-line switch when calling an external program, but it might not account for "--exec" or other switches that have the same semantics.

Common consequences

• Other: Other

Potential mitigations

• [Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues. • [Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.

Related

Child of · CWE (1)

  • CWE-75 Failure to Sanitize Special Elements into a Different Plane weakness

Referenced by CVE · weakness (16)

  • CVE-2026-91184 Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced… vulnerability
  • CVE-2026-66362 Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX… vulnerability
  • CVE-2026-77180 When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of… vulnerability
  • CVE-2026-54722 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. vulnerability
  • CVE-2026-55723 When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability… vulnerability
  • CVE-2026-11311 When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration… vulnerability
  • CVE-2026-28292 `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows… vulnerability
  • CVE-2024-4897 parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python… vulnerability
  • CVE-2024-34359 llama-cpp-python is the Python bindings for llama.cpp. vulnerability
  • CVE-2024-2952 BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. vulnerability
  • CVE-2024-1221 This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the… vulnerability
  • CVE-2024-1882 This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code… vulnerability
  • CVE-2024-1883 This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. vulnerability
  • CVE-2024-21600 An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS… vulnerability
  • CVE-2023-1149 Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. vulnerability
  • CVE-2023-0493 Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. vulnerability

Referenced by OWASP · mapped cwe (1)