security.execution

Constrain module-loading trust boundaries

`require()` and dynamic `import()` should not resolve modules from untrusted input.

#Metadata

#Why it matters

Untrusted module paths let attackers steer module-loading boundaries toward unintended files, packages, or plugins.

#Remediation

Resolve modules from a fixed allowlist or explicit dispatcher instead of untrusted request or event data.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.import-using-user-input.rule.yaml.