CWE-470
AllowedUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Abstraction: Base · Status: Draft
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
204 vulnerabilities reference this CWE, most recent first.
GHSA-X74X-QF5J-35JH
Vulnerability from github – Published: 2022-05-13 01:15 – Updated: 2022-06-01 19:41A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins.workflow:workflow-cps"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.65"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-1003041"
],
"database_specific": {
"cwe_ids": [
"CWE-470"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-01T19:41:15Z",
"nvd_published_at": "2019-03-28T18:29:00Z",
"severity": "CRITICAL"
},
"details": "A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.",
"id": "GHSA-x74x-qf5j-35jh",
"modified": "2022-06-01T19:41:15Z",
"published": "2022-05-13T01:15:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003041"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/2e5a67fde9baf25315fe692161b4e90d401da86c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1423"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/workflow-cps-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/03/28/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107628"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin"
}
GHSA-XQ6X-WP93-JJH6
Vulnerability from github – Published: 2026-09-23 00:31 – Updated: 2026-09-23 00:31IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
{
"affected": [],
"aliases": [
"CVE-2026-18123"
],
"database_specific": {
"cwe_ids": [
"CWE-470"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-22T22:17:09Z",
"severity": "HIGH"
},
"details": "IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.",
"id": "GHSA-xq6x-wp93-jjh6",
"modified": "2026-09-23T00:31:14Z",
"published": "2026-09-23T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18123"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7288641"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XW58-HP5C-6WC2
Vulnerability from github – Published: 2026-09-30 09:31 – Updated: 2026-09-30 09:31A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
{
"affected": [],
"aliases": [
"CVE-2026-102580"
],
"database_specific": {
"cwe_ids": [
"CWE-470"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T09:17:15Z",
"severity": "LOW"
},
"details": "A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.",
"id": "GHSA-xw58-hp5c-6wc2",
"modified": "2026-09-30T09:31:12Z",
"published": "2026-09-30T09:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102580"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-102580"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543635"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=482498"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-89078"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXGP-PCFC-3VGC
Vulnerability from github – Published: 2020-06-15 19:57 – Updated: 2022-07-20 14:21In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.4.Final"
},
"package": {
"ecosystem": "Maven",
"name": "org.hibernate:hibernate-validator"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.5.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.3.5.Final"
},
"package": {
"ecosystem": "Maven",
"name": "org.hibernate:hibernate-validator"
},
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.4.1.Final"
},
"package": {
"ecosystem": "Maven",
"name": "org.hibernate:hibernate-validator"
},
"ranges": [
{
"events": [
{
"introduced": "5.4.0"
},
{
"fixed": "5.4.2.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-7536"
],
"database_specific": {
"cwe_ids": [
"CWE-470"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-11T18:50:29Z",
"nvd_published_at": "2018-01-10T15:29:00Z",
"severity": "HIGH"
},
"details": "In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().",
"id": "GHSA-xxgp-pcfc-3vgc",
"modified": "2022-07-20T14:21:17Z",
"published": "2020-06-15T19:57:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536"
},
{
"type": "WEB",
"url": "https://github.com/hibernate/hibernate-validator/commit/0886e89900d343ea20fde5137c9a3086e6da9ac"
},
{
"type": "WEB",
"url": "https://github.com/hibernate/hibernate-validator/commit/0778a5c98b817771a645c6f4ba0b28dd8b5437b"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E"
},
{
"type": "PACKAGE",
"url": "https://github.com/hibernate/hibernate-validator"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1465573"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3817"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2927"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2743"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2742"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2741"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2740"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3458"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3456"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3455"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3454"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3141"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2811"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2809"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2808"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101048"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039744"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Privilege Escalation in Hibernate Validator"
}
Mitigation
Refactor your code to avoid using reflection.
Mitigation
Do not use user-controlled inputs to select and load classes or code.
Mitigation
Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.
CAPEC-138: Reflection Injection
An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application.