CWE-375
Returning a Mutable Object to an Untrusted Caller
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
Impactr finds and proves whether CWE-375 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.