CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

BaseDraft

Description

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

If the product uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-138

CVEs mapped to this weakness (84)

page 5 of 5

CVE	Vendor / Product	Sev	CVSS	EPSS	Published	Description
CVE-2026-40008	Apache Iotdb	Cri	9.8	0.00	Jul 10, 2026	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This…
CVE-2026-24246	Nvidia Megatron Bridge	Hig	7.8	0.00	Jul 1, 2026	NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information…
CVE-2026-13772	IBM Websphere Extreme Scale	Hig	7.5	0.00	Jun 30, 2026	IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators);…
CVE-2021-31522	Apache Kylin	Cri	9.8	0.03	Jan 6, 2022	Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

CVE-2026-40008CriJul 10, 2026
Apache
Iotdb
risk 0.00cvss 9.8epss 0.00
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This…
CVE-2026-24246HigJul 1, 2026
Nvidia
Megatron Bridge
risk 0.00cvss 7.8epss 0.00
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information…
CVE-2026-13772HigJun 30, 2026
IBM
Websphere Extreme Scale
risk 0.00cvss 7.5epss 0.00
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators);…
CVE-2021-31522CriJan 6, 2022
Apache
Kylin
risk 0.00cvss 9.8epss 0.03
Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.