Weaknesses of type CWE-95
224 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2026-4837MEDIUMEval Injection in Rapid7 Insight AgentEPSS 0.4%CVE-2026-40316HIGHOWASP BLT has RCE in Github Actions via untrusted Django model execution in workflowEPSS 0.4%CVE-2026-24474MEDIUMDioxus Components has JavaScript injection via user-supplied IDsEPSS 0.4%CVE-2026-5971MEDIUMFoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injectionEPSS 0.4%CVE-2026-27702CRITICALBudibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)EPSS 0.4%CVE-2026-78550MEDIUMImproper Input Handling in Okta Access Gateway Management Console Exception HandlerEPSS 0.4%CVE-2024-45858HIGHAn arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the wayEPSS 0.4%CVE-2025-32435LOWHydra no restricted eval after nix-eval-jobs migrationEPSS 0.4%CVE-2024-27320HIGHAn arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classifiEPSS 0.4%CVE-2026-75062CRITICALEval Injection in google/langfun via default lf.query protocolEPSS 0.4%CVE-2026-76974MEDIUMInformation Disclosure vulnerability in SAP Fiori LaunchpadEPSS 0.3%CVE-2024-27321HIGHAn arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabEPSS 0.3%CVE-2026-44344MEDIUMChamilo LMS: Conditional PHP execution through vendored QuickForm evalEPSS 0.3%CVE-2026-63350CRITICALAffected devices do not properly restrict executable content contained in imported trace files.
This could allow an attacker to social enEPSS 0.3%CVE-2026-33618HIGHChamilo LMS Affected by Remote Code Execution via eval() in Platform SettingsEPSS 0.3%CVE-2023-7245HIGHThe nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to EPSS 0.3%CVE-2026-100840HIGHMONAI through 1.6.0 Remote Code Execution via bundle configurationEPSS 0.3%CVE-2025-65530HIGHAn eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary filesEPSS 0.3%CVE-2025-6101MEDIUMletta-ai letta interface.py function_message eval injectionEPSS 0.3%CVE-2026-85486HIGHBrocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a EPSS 0.3%