C#: Add CWE-73 tag to cs/assembly-path-injection

jketema · jketema · commit 66fea698a20b · 2026-07-09T17:10:13.000+02:00
Use of CWE-114 is discoraged, and CWE-73 seems appropriate as the assembly
path is user controlled here.
diff --git a/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql b/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql
@@ -9,6 +9,7 @@
  * @security-severity 8.2
  * @precision high
  * @tags security
+ *       external/cwe/cwe-073
  *       external/cwe/cwe-114
  */
 
diff --git a/csharp/ql/src/change-notes/2026-07-09-CWE-114.md b/csharp/ql/src/change-notes/2026-07-09-CWE-114.md
@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Added the tag `external/cwe/cwe-073` to `cs/assembly-path-injection`.

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +category: queryMetadata
 +---
 +* Added the tag `external/cwe/cwe-073` to `cs/assembly-path-injection`.