Common Weakness Enumeration
CWE-214 Invocation of Process Using Visible Sensitive Information
Description
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-214 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-94p4-4cq8-9g67 | - | HIGH |
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) |
2026-09-24 | |
| GHSA-m8f5-rh7h-vgg3 | CVE-2026-61670 | MODERATE | - |
microsandbox: Secret values exposed in world-readable process arguments |
2026-09-22 |
| GHSA-pj2r-f9mw-vrcq | CVE-2026-40159 | MODERATE |
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution |
2026-04-10 | |
| GHSA-fjrv-vx9m-4jpj | CVE-2023-25722 | MODERATE |
Veracode Scan Jenkins Plugin vulnerable to information disclosure |
2023-04-05 | |
| GHSA-339q-62wm-c39w | CVE-2021-3859 | HIGH |
Undertow vulnerable to Denial of Service (DoS) attacks |
2022-09-08 |