> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/code-analysis/supported-weaknesses.md). # Supported Weaknesses ## Application CWE Coverage | CWE | Weakness | Coverage Highlights | | ------- | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | CWE-20 | Improper Input Validation | Identifies missing validation, untrusted deserialisation, and unsafe type coercion before data reaches sensitive sinks. | | CWE-22 | Path Traversal | Tracks file-system access from HTTP handlers, CLIs, and background jobs to prevent arbitrary file reads and writes. | | CWE-77 | Command Injection | Detects unsanitised command construction in shell runners, build tooling, and deployment scripts. | | CWE-78 | OS Command Injection | Finds user-controlled data reaching operating system calls (for example `exec`, `Runtime.exec`, `subprocess`, `ProcessBuilder`). | | CWE-79 | Cross-Site Scripting (XSS) | Covers reflected and stored variants across templating engines and SPA frameworks. | | CWE-89 | SQL Injection | Supports ORM and raw-query patterns in Go, Java, JavaScript/TypeScript, Ruby, PHP, Python, and Scala. | | CWE-94 | Code Injection | Flags dynamic evaluation, template injection, and remote code download scenarios. | | CWE-269 | Improper Privilege Management | Verifies authorisation guards, middleware ordering, and access control annotations. | | CWE-287 | Improper Authentication | Detects missing authentication, weak session handling, and uncontrolled login backdoors. | | CWE-352 | Cross-Site Request Forgery | Validates CSRF mitigations for web, API, and mobile backend endpoints. | | CWE-434 | Unrestricted File Upload | Ensures upload handlers enforce type, size, and storage-location controls. | | CWE-502 | Deserialisation of Untrusted Data | Flags unsafe use of native, JSON, XML, and binary deserialisers across languages. | | CWE-798 | Hard-coded Credentials | Surfaces embedded secrets in application code alongside Secrets Detection detections. | | CWE-918 | Server-Side Request Forgery | Detects pivot chains that reach cloud metadata services, internal control planes, or partner APIs. | ## Compound Attack Paths Beyond single-CWE detections, Nullify correlates findings across layers to surface chained, real-world attack paths: * **Cloud-to-code pivots** — links an infrastructure-as-code misconfiguration to the vulnerable application route it exposes, so an internet-facing service with a reachable injection flaw is prioritized over the same flaw buried in an internal job. * **Network reachability** — reasons over VPC, security-group, NACL, and gateway configuration to determine whether a vulnerable asset is actually reachable from the internet, feeding Cloud Audit prioritization. * **Container and build hardening** — catches Dockerfile and container-image misuse, image-provenance gaps, and privilege-escalation vectors. Runtime API exploration and authenticated exploit testing belong to [Bug Hunts](/capabilities/bug-hunts.md) and [Pentests](/capabilities/pentests.md), not to the static rules listed on this page. ## Rule-backed CWE catalog The bundled static rules carry the following CWE mappings. A mapping indicates a rule exists for that weakness; it does not promise detection of every instance, language, or exploit variant. The examples above explain common classes. | CWE | Rule metadata label | | -------- | ---------------------------------------------------------------------------------------------------------------------- | | CWE-20 | Improper Input Validation | | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | | CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | | CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | | CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | | CWE-91 | XML Injection (aka Blind XPath Injection) | | CWE-94 | Improper Control of Generation of Code ('Code Injection') | | CWE-116 | Improper Encoding or Escaping of Output | | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | | CWE-125 | Out-of-bounds Read | | CWE-129 | Improper Validation of Array Index | | CWE-134 | Use of Externally-Controlled Format String | | CWE-190 | Integer Overflow or Wraparound | | CWE-193 | Off-by-one Error | | CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | | CWE-203 | Observable Discrepancy | | CWE-209 | Generation of Error Message Containing Sensitive Information | | CWE-252 | Unchecked Return Value | | CWE-269 | Improper Privilege Management | | CWE-276 | Incorrect Default Permissions | | CWE-287 | Improper Authentication | | CWE-290 | Authentication Bypass by Spoofing | | CWE-294 | Authentication Bypass by Capture-replay | | CWE-295 | Improper Certificate Validation | | CWE-306 | Missing Authentication for Critical Function | | CWE-307 | Improper Restriction of Excessive Authentication Attempts | | CWE-311 | Missing Encryption of Sensitive Data | | CWE-312 | Cleartext Storage of Sensitive Information | | CWE-319 | Cleartext Transmission of Sensitive Information | | CWE-326 | Inadequate Encryption Strength | | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | | CWE-330 | Use of Insufficiently Random Values | | CWE-335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) | | CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | | CWE-345 | Insufficient Verification of Data Authenticity | | CWE-346 | Origin Validation Error | | CWE-347 | Improper Verification of Cryptographic Signature | | CWE-352 | Cross-Site Request Forgery (CSRF) | | CWE-354 | Improper Validation of Integrity Check Value | | CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | | CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | | CWE-369 | Divide By Zero | | CWE-384 | Session Fixation | | CWE-400 | Uncontrolled Resource Consumption | | CWE-401 | Missing Release of Memory after Effective Lifetime | | CWE-404 | Improper Resource Shutdown or Release | | CWE-407 | Inefficient Algorithmic Complexity | | CWE-415 | Double Free | | CWE-416 | Use After Free | | CWE-427 | Uncontrolled Search Path Element | | CWE-434 | Unrestricted Upload of File with Dangerous Type | | CWE-436 | Interpretation Conflict | | CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | | CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | | CWE-476 | NULL Pointer Dereference | | CWE-494 | Download of Code Without Integrity Check | | CWE-502 | Deserialization of Untrusted Data | | CWE-521 | Weak Password Requirements | | CWE-522 | Insufficiently Protected Credentials | | CWE-532 | Insertion of Sensitive Information into Log File | | CWE-552 | Files or Directories Accessible to External Parties | | CWE-565 | Reliance on Cookies without Validation and Integrity Checking | | CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | | CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | | CWE-611 | Improper Restriction of XML External Entity Reference | | CWE-613 | Insufficient Session Expiration | | CWE-639 | Authorization Bypass Through User-Controlled Key | | CWE-665 | Improper Initialization | | CWE-668 | Exposure of Resource to Wrong Sphere | | CWE-669 | Incorrect Resource Transfer Between Spheres | | CWE-672 | Operation on a Resource after Expiration or Release | | CWE-674 | Uncontrolled Recursion | | CWE-681 | Incorrect Conversion between Numeric Types | | CWE-682 | Incorrect Calculation | | CWE-697 | Incorrect Comparison | | CWE-704 | Incorrect Type Conversion or Cast | | CWE-706 | Use of Incorrectly-Resolved Name or Reference | | CWE-732 | Incorrect Permission Assignment for Critical Resource | | CWE-754 | Improper Check for Unusual or Exceptional Conditions | | CWE-755 | Improper Handling of Exceptional Conditions | | CWE-770 | Allocation of Resources Without Limits or Throttling | | CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | | CWE-787 | Out-of-bounds Write | | CWE-798 | Use of Hard-coded Credentials | | CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | | CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | | CWE-862 | Missing Authorization | | CWE-863 | Incorrect Authorization | | CWE-908 | Use of Uninitialized Resource | | CWE-913 | Improper Control of Dynamically-Managed Code Resources | | CWE-916 | Use of Password Hash With Insufficient Computational Effort | | CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | | CWE-918 | Server-Side Request Forgery (SSRF) | | CWE-922 | Insecure Storage of Sensitive Information | | CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | | CWE-1188 | Initialization of a Resource with an Insecure Default | | CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | | CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | | CWE-1333 | Inefficient Regular Expression Complexity |