CWE-159 is a class level weakness. It describes a product that does not properly filter, remove, quote or otherwise manage the invalid use of special elements in user controlled input, which could harm its behavior and integrity.
Think of it as the parent of many narrower entries about quotes, whitespace, delimiters and null bytes. Any code that takes outside input and passes it to something with syntax lives here.
How it happens
Special elements are characters with meaning to a downstream parser. Invalid use means they appear where the parser does not expect them: extra, missing, out of order or in the wrong place.
Two observed examples show the range. CVE-2002-1362 is a crash from a message type without a separator character. CVE-2000-0116 is an extra less than sign in front of a script tag that bypasses cross-site scripting prevention. One is a failure to handle something missing. The other is a failure to handle something extra.
What an attacker gains
The record lists integrity impact as unexpected state. In practice it ranges from crashes to filter bypass.
How to find it
No detection methods are listed. Test with malformed input: missing separators, extra openers, wrong order, and repeated elements. Watch for crashes and changed output.
How to fix it
- Anticipate that special elements will be injected, removed or manipulated in your inputs.
- Use an appropriate combination of denylists and allowlists so only valid, expected input is processed.
- Assume all input is malicious. Accept known good values, and reject or transform anything that does not strictly conform to the specification.
- Consider length, type, range, syntax and consistency across related fields.
Quick check
Why is this a class rather than a single bug?
It names the shared mistake behind many narrower weaknesses. The specific entries describe which element went wrong.
