CWE-153Variant

Improper Neutralization of Substitution Characters

Draft in the CWE catalog · 5 CVEs mapped

5
CVEs mapped
8.9
Median CVSS
What it is

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.

Recent examples
2.6cvss
CVE-2026-9694

Improper Neutralization of Substitution Characters in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing.

LOWno explanation yet
0%
epss
8.9cvss
CVE-2025-53006

Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

⚡ A little oversight in DataEase can leave your connection vulnerable! Just before version 2.10.11, certain SSL parameters could be triggered post-connection, which sounds simple, but it opens the door to some serious security concerns! 🔥 Think of it like a restaurant that allows you to order wine only after you’ve finished your meal — you’ve already been served, and the damage could be done before anyone checks on the pairings! If exploited, an attacker could manipulate secure connections, potentially intercepting sensitive data or executing malicious commands. This could lead to unauthorized access, data breaches, or even data manipulation, making the consequences absolutely devastating!

HIGH
1%
epss
8.9cvss
CVE-2025-53005

Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability

⚡ A sneaky bypass vulnerability in DataEase could let an attacker slip past security measures with just the right JDBC parameters! 🔥 Think of it like a restaurant where a clever diner finds an open side door to the kitchen, sneaking in undetected to whip up their own dish! If exploited, this vulnerability could allow unauthorized access to your PostgreSQL data source, potentially leading to data leaks or manipulation. That's absolutely devastating for any business relying on DataEase for their intelligence and insights!

HIGH
1%
epss
The record
Technical detail
CWE ID
CWE-153
Abstraction
Variant
Structure
Simple
Status
Draft