CWE-138Improper Neutralization of Special Elements

Abstraction: Class · CVEs in our corpus: 14

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Most languages and protocols have their own special elements such as characters and reserved words. These special elements can carry control implications. If product does not prevent external control or influence over the inclusion of such special elements, the control flow of the program may be altered from what was intended. For example, both Unix and Windows interpret the symbol < ("less than") as meaning "read input from a file".

Last updated: 14 October 2026 20:41 UTC

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-42117`	8.0	9.8	0.0679	2024-05-03
`CVE-2023-7012`	6.7	9.6	0.0032	2024-07-16
`CVE-2026-32178`	6.2	7.5	0.0209	2026-04-14
`CVE-2024-38133`	6.0	7.8	0.0073	2024-08-13
`CVE-2026-26129`	6.0	7.5	0.0103	2026-05-07
`CVE-2026-55841`	5.9	7.5	0.0063	2026-08-28
`CVE-2022-0024`	5.8	7.2	0.0161	2022-05-11
`CVE-2025-5878`	5.7	7.3	0.0050	2025-06-29
`CVE-2022-2429`	5.1	6.5	0.0091	2022-09-06
`CVE-2024-51500`	4.4	5.3	0.0042	2024-11-04
`CVE-2026-20009`	4.4	5.3	0.0040	2026-03-04
`CVE-2016-0750`	4.0	4.2	0.0242	2018-09-11
`CVE-2023-22288`	3.4	4.1	0.0040	2023-03-20
`CVE-2025-48939`	3.2	4.2	0.0020	2025-07-03