Nome: Missing User Interaction for Potentially Unsafe Action

The product encounters a situation in which some of its behavior is security-critical and should be authorized by a human before progressing, but it does not properly consult with the human user or its proxy (such as UI approval dialogues or pre-set policies) to determine whether it is allowed to perform the potentially dangerous behavior.

General Informations

Modes Of Introduction

Architecture and Design : The architecture or design might include a component or potentially dangerous functionality that could effectively act independently.
Implementation : A bug in the implementation could cause the product to fail to recognize that it is about to perform a dangerous operation requiring a human decision.

Piattaforme applicabili

Linguaggio

Classe: Not Language-Specific (Undetermined)

Architetture

Classe: Not Architecture-Specific (Undetermined)

Tecnologie

Nome: AI/ML (Undetermined)
Classe: Not Technology-Specific (Undetermined)

Conseguenze comuni

Ambito	Impatto	Probabilità
Non-Repudiation	Hide Activities Nota: This makes it easier for attackers to trick users into inflicting damage to their system.

Esempi osservati

Riferimenti	Descrizione
CVE-2000-0788	Document editor runs macros without asking for user approval.
CVE-2003-0660	OS does not prompt the user to download and install ActiveX controls when the system is low on memory.
CVE-2008-2540	Chain: Web browser does not prompt the user before downloading an object that has an unrecognized content type (CWE-356), leading to untrusted search path (CWE-426) on a different OS.
CVE-2026-10591	AI agentic IDE product for cloud service does not consult the "Human-in-the-Loop" (HITL) in some security-critical decisions, allowing rewrite of its own Model Context Protocol (MCP), leading to configuration change and code execution [REF-1582].
CVE-2026-33068	AI agentic coding tool trusts a potentially-untrusted configuration input, causing it to skip a "trust confirmation dialog" before conducting potentially dangerous actions.
CVE-2025-59828	Chain: AI agentic coding tool auto-executes Yarn plugins in untrusted directories (CWE-696) before asking the user to approve the action (CWE-356).
CVE-1999-1055	Product does not warn user when document contains certain dangerous functions or macros.
CVE-1999-0794	Product does not warn user when document contains certain dangerous functions or macros.
CVE-2000-0277	Product does not warn user when document contains certain dangerous functions or macros.
CVE-2000-0517	Product does not warn user about a certificate if it has already been accepted for a different site. Possibly resultant.
CVE-2005-0602	File extractor does not warn user if setuid/setgid files could be extracted. Overlaps privileges/permissions.
CVE-2000-0342	Chain: E-mail client allows bypass of warning for dangerous attachments (CWE-356) via a Windows .LNK file that refers to the attachment (CWE-64).

Potential Mitigations

Phases : Architecture and Design
Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.

Note sulla mappatura delle vulnerabilità

Giustificazione : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commento : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Note

Often resultant, e.g. in unhandled error conditions.
Can overlap privilege errors, conceptually at least.

Riferimenti

REF-1582

When the AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability in AWS's Agentic IDE
Nicole Fishbein, Eran Segal.
https://www.kodemsecurity.com/resources/aws-kiro-agentic-ide-rce-prompt-injection-mcp-config-vulnerability

REF-1583

Human-in-the-loop
LangChain.
https://docs.langchain.com/oss/python/langchain/human-in-the-loop

REF-1584

Human-in-the-loop
Wikipedia.
https://en.wikipedia.org/wiki/Human-in-the-loop

Invio

Nome	Organizzazione	Data	Data di rilascio	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

Modifiche

Nome	Organizzazione	Data	Commento
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Relationship_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, References, Relationships

CWE-356 Detail

CWE-356