Loading story…
OWASP continues to classify injection flaws as a major application security risk, covering weaknesses such as SQL injection, command injection, and cross-site scripting that arise when untrusted input reaches interpreters without proper validation or sanitization. The guidance emphasizes separating code from data, validating input, and using safe APIs to prevent attackers from altering queries, commands, or application logic.
Semgrep said its taint mode reached beta in v0.70.0, adding lightweight intra-procedural taint analysis to track sources, sanitizers, and sinks more effectively than pattern-only rules for finding injection bugs. The company highlighted use cases including Angular XSS and sandbox code injection, while also pointing developers to common SQL injection pitfalls in Django applications, where the ORM is generally safer by default but raw SQL, custom ORM expressions, and QuerySet.extra() can still expose applications if user input is interpolated instead of passed through parameterized queries.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Semgrep announced that taint mode became officially beta in Semgrep v0.70.0 and said it planned to make the capability generally available on a per-language basis, starting with JavaScript.
The Semgrep blog says taint mode was significantly improved in 2021 Q3, advancing the feature beyond its initial experimental state.
Semgrep's taint mode was introduced experimentally in 2020 as a lightweight intra-procedural taint analysis capability aimed at finding injection vulnerabilities more effectively than pattern-only rules.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Semgrep added three JavaScript-focused rulesets to its registry—`p/javascript`, `p/nodejs`, and `p/expressjs`—to separate browser-side JavaScript checks from Node.js API misuse and Express framework misconfigurations. The expanded coverage includes detections for **prototype pollution**, bracket object injection, non-literal regular expressions, hardcoded secrets, shell command execution with `shell=true`, weak cryptography, TLS misconfigurations, insecure cookie settings, CORS issues, response injection, and XSS patterns. The JavaScript coverage aligns with long-standing research into prototype pollution attacks in Node.js, a class of flaws that can let attackers tamper with object inheritance and trigger unsafe application behavior. The release comes alongside broader discussion of JavaScript static analysis tradeoffs as GitLab shifted most of its SAST analyzers from ESLint and Bandit to Semgrep. Semgrep said its approach offers easier custom rule authoring, multilingual support, and stronger CI/CD integration, while comparisons noted that ESLint can be faster and produce fewer false positives in some JavaScript cases. Semgrep also published guidance for building higher-quality custom rules, recommending iterative testing against real repositories, use of constructs such as `pattern-not` and `pattern-either`, and continuous tuning to reduce false positives and false negatives before enforcing scans in pull requests.
Jul 24, 2026
Semgrep reported that AI coding agents from Anthropic and OpenAI identified genuine vulnerabilities in large open-source web applications, but produced high false-positive rates and inconsistent results across repeated scans. In a study of 11 actively maintained Python web apps, researchers manually triaged 445 findings and confirmed 46 true vulnerabilities from **Claude Code** and 21 from **OpenAI Codex**, with roughly 20 of the validated issues rated high severity. The company said responsible disclosure is still underway and did not name the affected applications. The results showed uneven detection performance by vulnerability class: Claude Code performed best on **IDOR**, Codex performed best on **path traversal**, and both models struggled significantly with injection flaws such as `SQL injection` and `XSS`. The findings align with the broader role of intentionally vulnerable projects such as **OWASP Juice Shop** and **OWASP Benchmark**, which are widely used to evaluate security testing tools against exploitable web application weaknesses across SAST, DAST, and IAST scenarios.
Jul 24, 2026
Attackers have demonstrated the exploitation of SQL injection vulnerabilities in web applications through the use of UNION-based attacks, specifically targeting product category filters. In both documented cases, the web applications failed to properly sanitize or validate user-supplied input, allowing malicious actors to inject arbitrary SQL code into backend queries. The first scenario details how attackers can use a UNION attack to identify which columns in a database query are compatible with text data, a crucial step in crafting effective payloads for data extraction. By systematically testing columns, attackers can determine which ones will accept string values, enabling them to retrieve sensitive information from the database. The second scenario focuses on PostgreSQL 12.22 and illustrates how a UNION-based SQL injection can be used to retrieve multiple values from a single column. This technique allows attackers to concatenate or enumerate data, increasing the efficiency and impact of the attack. Both references emphasize the serious risk posed by such vulnerabilities, as they can lead to unauthorized access to sensitive data, compromise of user privacy, and potential full database compromise. The proof-of-concept steps provided in each case show how easily these attacks can be reproduced in vulnerable environments, underscoring the importance of robust input validation and query parameterization. The impact of these vulnerabilities is significant, as attackers can bypass authentication, escalate privileges, or exfiltrate confidential information. The educational materials stress that these techniques are intended for ethical use only, warning that unauthorized exploitation is illegal and unethical. The documentation also highlights the need for organizations to regularly test their web applications for SQL injection flaws, particularly in areas where user input is incorporated into database queries. Security teams are advised to implement strict input validation, use prepared statements, and conduct regular code reviews to mitigate the risk. The examples provided demonstrate that even seemingly innocuous features like product category filters can be vectors for serious attacks if not properly secured. The references also note that attackers often target such features because they are commonly overlooked during security assessments. Both sources provide detailed technical guidance on identifying and exploiting these vulnerabilities, making them valuable resources for defenders seeking to understand and remediate SQL injection risks. The overall message is clear: SQL injection remains a prevalent and dangerous threat, and organizations must remain vigilant in securing all user input points. Failure to address these vulnerabilities can result in severe consequences, including data breaches, regulatory penalties, and reputational damage. The documentation serves as a reminder that proactive security measures are essential to protect against evolving attack techniques.
Jun 29, 2026