{
  "node_id": "mitre-cwe-20-improper-input-validation",
  "title": "MITRE CWE-20 - Improper Input Validation",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-05",
  "bluf": "CWE-20 (Improper Input Validation) is one of the most foundational and broadly applicable software security weaknesses, ranked consistently near the top of the CWE Top 25. CWE-20 is defined as: the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. The Extended Description identifies two forms of input: raw data (strings, numbers, parameters, file contents) and metadata (information about the raw data such as headers or size). Properties requiring validation include specified quantities (size, length, frequency, price, rate, number of operations, time); well-formedness (syntactic correctness); specified or derived type (actual type or apparent type); consistency (between individual data elements, between raw data and metadata, between references); conformance to domain-specific rules (business logic); and authenticity, ownership, or other attestations (e.g., a cryptographic signature). Common Consequences include availability impact (attackers providing unexpected values can crash programs or cause excessive resource consumption of CPU or memory); confidentiality impact (attackers controlling resource references may read confidential data or access files); and integrity and availability impact (an attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution). The Potential Mitigations include attack-surface reduction via an accept-known-good input validation strategy using a list of acceptable inputs that strictly conform to specifications; assume all input is malicious; validate length, type, acceptable value ranges, missing or extra inputs, syntax, consistency, and business rule conformance; ensure all client-side security checks are duplicated on the server side; and canonicalize inputs to the application's current internal representation before validation. CWE-20 is the parent weakness for many specific injection and parsing weaknesses including CWE-78 (OS command injection), CWE-79 (XSS), CWE-89 (SQL injection), and CWE-22 (path traversal).",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "industry_mapping",
      "related_frameworks"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-cwe-top-25-2024-most-dangerous-weaknesses"
  ],
  "primary_citations_count": 9
}