Weaknesses of type CWE-95
196 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2026-61539CRITICALXinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsingEPSS 0.7%CVE-2026-61667CRITICALDIRAC: RCE in FileCatalog DatasetManager via SQL injection + evalEPSS 0.7%CVE-2025-53837CRITICALorg.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueEPSS 0.6%CVE-2024-3562HIGHCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom FieldEPSS 0.6%CVE-2026-69253CRITICALFlowise Sandbox Escape to RCEEPSS 0.6%CVE-2025-68271CRITICALUnauthenticated Remote Code Execution in openc3-apiEPSS 0.6%CVE-2026-71864CRITICALOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientEPSS 0.6%CVE-2026-71867CRITICALOrval: RCE via schema property name -> computed-property-key injection in the MSW mock generatorEPSS 0.6%CVE-2023-0888MEDIUMAuthenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi EPSS 0.6%CVE-2026-4965MEDIUMletta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injectionEPSS 0.6%CVE-2025-71361HIGHpicklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tipEPSS 0.6%CVE-2023-26323HIGHXiaomi App Market has a code execution vulnerabilityEPSS 0.6%CVE-2026-15971CRITICALCVE-2026-15971EPSS 0.6%CVE-2025-58365HIGHXWiki Blog Application: Privilege Escalation (PR) from account through blog contentEPSS 0.6%CVE-2020-37137HIGHPHP-Fusion 9.03.50 - 'panels.php' Eval InjectionEPSS 0.6%CVE-2026-46586HIGHApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code ExecutionEPSS 0.5%CVE-2024-31986CRITICALXWiki Platform CSRF remote code execution through scheduler job's document referenceEPSS 0.5%CVE-2024-10633HIGHQuiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via contentEPSS 0.5%CVE-2026-8914HIGHCommand injection in Profile change functionEPSS 0.5%CVE-2026-80351CRITICALApache Camel K: Camel K Tenant repositories reach Maven execution inside operator podEPSS 0.5%