HIGHCWE-176
PARSE-004 Unicode Normalization Bypass
Parser Differential: Exploits differences in how parsers (JSON, YAML, markdown) interpret the same input to bypass security controls
Description
Uses Unicode normalization forms (NFC vs NFD) to create visually identical but byte-different strings that bypass allowlist/blocklist filters
Remediation
Normalize all input to NFC form before validation. Apply security filters after normalization, not before. Use Unicode-aware string comparison.