CWE-138Improper Neutralization of Special Elements

Abstraction: Class · CVEs in our corpus: 13

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Most languages and protocols have their own special elements such as characters and reserved words. These special elements can carry control implications. If product does not prevent external control or influence over the inclusion of such special elements, the control flow of the program may be altered from what was intended. For example, both Unix and Windows interpret the symbol < ("less than") as meaning "read input from a file".

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 1 framework(s): CAPEC 3 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SI-10 Information Input Validation
SA-8 Security and Privacy Engineering Principles
SI-15 Information Output Filtering

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.3.12

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-42117`	8.0	9.8	0.0572	2024-05-03
`CVE-2023-7012`	6.7	9.6	0.0032	2024-07-16
`CVE-2026-32178`	6.3	7.5	0.0228	2026-04-14
`CVE-2026-26129`	6.1	7.5	0.0114	2026-05-07
`CVE-2024-38133`	6.0	7.8	0.0073	2024-08-13
`CVE-2022-0024`	5.7	7.2	0.0151	2022-05-11
`CVE-2025-5878`	5.7	7.3	0.0040	2025-06-29
`CVE-2022-2429`	5.0	6.5	0.0071	2022-09-06
`CVE-2024-51500`	4.4	5.3	0.0042	2024-11-04
`CVE-2026-20009`	4.4	5.3	0.0038	2026-03-04
`CVE-2016-0750`	4.0	4.2	0.0240	2018-09-11
`CVE-2023-22288`	3.4	4.1	0.0040	2023-03-20
`CVE-2025-48939`	3.2	4.2	0.0018	2025-07-03