Weaknesses of type CWE-95
196 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2025-65530HIGHAn eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary filesEPSS 0.3%CVE-2026-48962HIGHIO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output globEPSS 0.3%CVE-2026-72904CRITICALFirecrawl: Arbitrary file read via JSON Schema $ref expansionEPSS 0.3%CVE-2023-6735HIGHPrivilege escalation in mk_tsmEPSS 0.3%CVE-2025-55585MEDIUMTOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.EPSS 0.3%CVE-2026-42603HIGHOWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_targetEPSS 0.3%CVE-2026-31254HIGHThe flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-9EPSS 0.2%CVE-2025-61955HIGHF5OS vulnerabilityEPSS 0.2%CVE-2026-6652MEDIUMPagekit CMS StringStorage Template PhpEngine.php evaluate eval injectionEPSS 0.2%CVE-2023-7224HIGHOpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSEREPSS 0.2%CVE-2026-75062CRITICALEval Injection in google/langfun via default lf.query protocolEPSS 0.2%CVE-2025-43466MEDIUMAn injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive uEPSS 0.2%CVE-2026-34398HIGHFreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM WorkbenchEPSS 0.2%CVE-2026-73231HIGHFaker: helpers.fake exploitable into arbritary code executionEPSS 0.2%CVE-2025-43388LOWAn injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive uEPSS 0.2%CVE-2026-76974MEDIUMInformation Disclosure vulnerability in SAP Fiori LaunchpadEPSS 0.2%CVE-2026-73248HIGHcalibre: Bypass of Python template restrictions via nested `template()` leading to RCEEPSS 0.2%CVE-2026-63325HIGHRedocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`EPSS 0.2%CVE-2026-52858HIGHVim: Arbitrary Code Execution via Python Omni-CompletionEPSS 0.2%CVE-2025-71408HIGHNLTK < 3.9.3 Eval Injection via collocations.py Command-Line ArgumentsEPSS 0.2%