CWE-74 Injection

Coverage: 24 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 19Other-pattern 5 Also: AI-context engineTaint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged an "injection-shaped" pattern: untrusted input is being used to build something that will later be interpreted (SQL, commands, HTML, templates, headers, file paths).

Why it matters

Injection enables attackers to run unintended commands or queries.

• It often leads to data leaks, auth bypass, or code execution, depending on the sink.
• Injection issues frequently chain: one bug becomes many once attackers control interpretation.

Safer examples

1) Parameterize queries (don't concatenate)

await db.query("SELECT * FROM users WHERE id = $1", [id]);

2) Use safe APIs (avoid "interpret me" sinks)

Use textContent instead of innerHTML, argument arrays instead of shell strings, and allowlists for dynamic behavior.

3) Validate at trust boundaries

Validate inputs in request handlers and reject unexpected shapes/lengths (see CWE-20).

How SiteShadow detects it (high level)

• Detects dangerous sinks (SQL execution, command execution, HTML/DOM sinks, header sinks) and checks for user-controlled sources.
• Uses context heuristics to reduce false positives when safe APIs are used.

References

• CWE-74: https://cwe.mitre.org/data/definitions/74.html

---

← Back to Vulnerability Library