CWEweakness
CWE-830 Inclusion of Web Functionality from an Untrusted Source
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Common consequences
• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands — Including third party functionality in a web-based environment is risky, especially if the source of the functionality is untrusted.
Even if the third party is a trusted source, the product may still be exposed to attacks and malicious behavior if that trusted source is compromised, or if the code is modified in transmission from the third party to the product. Such dependencies may be desirable, or even required, but sometimes programmers are not aware that a dependency exists.
Related
Child of · CWE (1)
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
Referenced by CVE · weakness (13)
- CVE-2025-61478 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial… vulnerability
- CVE-2025-65109 Minder is an open source software supply chain security platform. vulnerability
- CVE-2025-64496 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. vulnerability
- CVE-2025-46652 In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. vulnerability
- CVE-2025-43703 An issue was discovered in Ankitects Anki through 25.02. vulnerability
- CVE-2025-33026 In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. vulnerability
- CVE-2025-33027 In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. vulnerability
- CVE-2025-33028 In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. vulnerability
- CVE-2024-42381 os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to… vulnerability
- CVE-2024-35180 OMERO.web provides a web based client and plugin infrastructure. vulnerability
- CVE-2024-29944 An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent… vulnerability
- CVE-2023-2588 Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell… vulnerability
- CVE-2021-28162 In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. vulnerability