Weaknesses of type CWE-95
196 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2025-3753HIGHUnsafe use of eval() method in rosbag toolEPSS 0.2%CVE-2024-41921HIGHUnsafe use of eval() method in rostopic echo toolEPSS 0.2%CVE-2024-41148HIGHUnsafe use of eval() method in rostopic hz toolEPSS 0.2%CVE-2026-78136HIGHchirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.EPSS 0.2%CVE-2026-45293HIGHWordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityEPSS 0.2%CVE-2025-49598MEDIUMconda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version ParsingEPSS 0.2%CVE-2024-39289HIGHUnsafe use of eval() method in rosparam toolEPSS 0.2%CVE-2024-39835HIGHUnsafe use of eval() method in roslaunch toolEPSS 0.2%CVE-2026-39423MEDIUMStored XSS via Eval Injection in EchartsRander ComponentEPSS 0.2%CVE-2026-78847CRITICALAn issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter wEPSS 0.2%CVE-2026-11422HIGHMarkdown Preview Enhanced 0.8.x Code Injection via WaveDrom RenderingEPSS 0.2%CVE-2026-76833HIGH@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML TagEPSS 0.2%CVE-2026-42079HIGHPPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in ScopeEPSS 0.1%CVE-2026-47167MEDIUMVim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regexEPSS 0.1%CVE-2026-34399HIGHFreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw PageEPSS 0.1%CVE-2026-57149CRITICALplone.app.portlets Vulnerable to Remote Code Execution via TALES InjectionEPSS —