rules-erlang

Unchecked list_to_atom/binary_to_atom — CWE-400 (resource exhaustion). Erlang's atom table is limited (~1M atoms by default) and atoms are never garbage-collected. Creating atoms from untrusted input can exhaust the table and crash the VM. Use list_to_existing_atom/binary_to_existing_atom (which fails on unknown atoms) or keep values as binaries.

Dynamic module loading via code:load_binary/load_file — CWE-829. Loading beam bytecode from a remote or user-controlled source lets an attacker inject arbitrary code into the running VM. Only load modules from trusted, integrity-verified paths.

erl_eval evaluates arbitrary Erlang expressions at runtime — CWE-94. If user-controlled input reaches erl_eval, an attacker can execute any Erlang code including spawn, os:cmd, and file operations. Never pass untrusted input to the evaluator; use a restricted DSL or safe data transformations instead.

Hardcoded weak Erlang distribution cookie — CWE-798. The distribution cookie is the only authentication mechanism for EPMD/distributed Erlang; a guessable cookie lets any node on the network connect and execute arbitrary code with full VM access. Set a strong random cookie via environment variable injection or a secrets manager.

erlang:now/0 is deprecated since OTP 18 (returns monotonically adjusted timestamps that can block the runtime). Use os:system_time/1, erlang:monotonic_time/1, or erlang:timestamp/0 depending on whether you need wall-clock time, monotonic time, or Erlang-compatible timestamps.

os:cmd/1 passes a string to the shell and is vulnerable to command injection — CWE-78. Any unsanitized input passed to os:cmd can execute arbitrary OS commands. Use erlexec or a port with explicit argument lists instead of a shell string. If os:cmd is unavoidable, validate input against a strict allowlist.

TLS peer verification is disabled — CWE-297. '{verify, verify_none}' in ssl:connect/ssl:listen options means the server certificate is never checked, making TLS trivially bypassable by a MITM attacker. Use '{verify, verify_peer}' with a CA certificate bundle.