Weaknesses of type CWE-95
222 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2026-78136HIGHchirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.EPSS 0.2%CVE-2026-73231HIGHFaker: helpers.fake exploitable into arbritary code executionEPSS 0.2%CVE-2024-39289HIGHUnsafe use of eval() method in rosparam toolEPSS 0.2%CVE-2024-39835HIGHUnsafe use of eval() method in roslaunch toolEPSS 0.2%CVE-2026-52858HIGHVim: Arbitrary Code Execution via Python Omni-CompletionEPSS 0.2%CVE-2026-34399HIGHFreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw PageEPSS 0.2%CVE-2026-101861LOWLangflow Code Execution via eval() in Component Input SchemaEPSS 0.2%CVE-2026-73248HIGHcalibre: Bypass of Python template restrictions via nested `template()` leading to RCEEPSS 0.2%CVE-2026-78497HIGHJQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string evalEPSS 0.2%CVE-2026-69662LOWToptech TMS7 and TopHAT Eval InjectionEPSS 0.2%CVE-2026-100842HIGHMONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute ChainsEPSS 0.2%CVE-2025-49598MEDIUMconda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version ParsingEPSS 0.2%CVE-2026-39423MEDIUMStored XSS via Eval Injection in EchartsRander ComponentEPSS 0.2%CVE-2026-65141HIGHNVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might EPSS 0.2%CVE-2024-42002HIGHUnsafe use of eval() method in ros2 topic hz toolEPSS 0.2%CVE-2026-11422HIGHMarkdown Preview Enhanced 0.8.x Code Injection via WaveDrom RenderingEPSS 0.2%CVE-2026-65954HIGHPHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()EPSS 0.2%CVE-2026-42079HIGHPPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in ScopeEPSS 0.1%CVE-2026-47167MEDIUMVim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regexEPSS 0.1%CVE-2026-111237MEDIUMUltralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injectionEPSS 0.1%