Weaknesses of type CWE-95

224 results

Injeção em código avaliado dinamicamente (Eval Injection)

Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.

Example

Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.

How to mitigate

Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.

CVE-2026-90872MEDIUMServer-Side Script Injection in Manager Web UI in Progress WS_FTP ServerEPSS 0.3%CVE-2026-119121MEDIUMCrawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_forEPSS 0.3%CVE-2023-6735HIGHPrivilege escalation in mk_tsmEPSS 0.3%CVE-2025-71408HIGHNLTK < 3.9.3 Eval Injection via collocations.py Command-Line ArgumentsEPSS 0.3%CVE-2026-114424CRITICALCode execution through double evaluation in address replacement rulesEPSS 0.3%CVE-2026-105315MEDIUMdjango-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injectionEPSS 0.3%CVE-2025-55585MEDIUMTOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.EPSS 0.3%CVE-2025-61955HIGHF5OS vulnerabilityEPSS 0.3%CVE-2026-42603HIGHOWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_targetEPSS 0.3%CVE-2026-45293HIGHWordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityEPSS 0.2%CVE-2026-31254HIGHThe flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-9EPSS 0.2%CVE-2026-6652MEDIUMPagekit CMS StringStorage Template PhpEngine.php evaluate eval injectionEPSS 0.2%CVE-2023-7224HIGHOpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSEREPSS 0.2%CVE-2025-3753HIGHUnsafe use of eval() method in rosbag toolEPSS 0.2%CVE-2026-63325HIGHRedocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`EPSS 0.2%CVE-2026-34398HIGHFreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM WorkbenchEPSS 0.2%CVE-2024-41921HIGHUnsafe use of eval() method in rostopic echo toolEPSS 0.2%CVE-2025-43466MEDIUMAn injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive uEPSS 0.2%CVE-2024-41148HIGHUnsafe use of eval() method in rostopic hz toolEPSS 0.2%CVE-2026-76833HIGH@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML TagEPSS 0.2%