Weaknesses of type CWE-95

196 results

Injeção em código avaliado dinamicamente (Eval Injection)

Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.

Example

Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.

How to mitigate

Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.

CVE-2022-36010CRITICALArbitrary code execution via function parsing in react-editable-json-treeEPSS 1.5%CVE-2013-10070CRITICALPHP-Charts v1.0 PHP Code ExecutionEPSS 1.5%CVE-2026-47103CRITICALPython StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() InjectionEPSS 1.4%CVE-2026-19626CRITICALRemote Code ExecutionEPSS 1.3%CVE-2026-44939CRITICALCommand injection through unsanitized YAML parameter in RancherEPSS 1.3%CVE-2026-27493CRITICALn8n has Unauthenticated Expression Evaluation via Form NodeEPSS 1.3%CVE-2022-41931CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uiEPSS 1.2%CVE-2023-29212CRITICALxwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29211CRITICALorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29210CRITICALorg.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-29214CRITICALorg.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityEPSS 1.2%CVE-2023-50723CRITICALXWiki Platform remote code execution/programming rights with configuration section from any user accountEPSS 1.2%CVE-2026-47391CRITICALPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionEPSS 1.2%CVE-2026-69264CRITICALFlowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationEPSS 1.2%CVE-2026-67195HIGHPerspective 5.0.0 RCE via eval() Expression InjectionEPSS 1.2%CVE-2023-29209CRITICALorg.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerabilityEPSS 1.1%CVE-2024-43404CRITICALRemote Code Execution Vulnerability in MEGABOTEPSS 1.1%CVE-2023-40177CRITICALXWiki Platform privilege escalation (PR) from account through AWM content fieldsEPSS 1.1%CVE-2024-37901CRITICALXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetEPSS 1.1%CVE-2025-55727CRITICALXWiki Remote Macros vulnerable to remote code execution from width parameter in the column macroEPSS 1.0%