The description above is MITRE’s definition of CWE-116 in CWE 4.20, a class-level weakness.
Common consequences MITRE lists
- Integrity: Modify Application Data
- Integrity, Confidentiality, Availability, Access Control: Execute Unauthorized Code or Commands
- Confidentiality: Bypass Protection Mechanism
Guides on this site
Prevent XSS at the output boundary
Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
Practice
- XSS lab: Render a model’s answer as text instead of active markup · Browser lab
- HTML sanitization lab: Configure a sanitizer for user comments · Browser lab
- Actions injection lab: Flag GitHub Actions expression injection · Browser lab
- Repair a security pipeline for GitHub Actions and GitLab CI · Local project
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-116.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.