Fallos del tipo CWE-95

196 resultados

Injeção em Código Avaliado Dinamicamente (Eval Injection)

Fraqueza onde entrada do usuário é passada diretamente para funções que executam código dinamicamente (como eval(), exec() ou similar), sem validação ou sanitização prévia. Um atacante injeta comandos maliciosos que são interpretados e executados com os mesmos privilégios da aplicação, resultando em execução remota de código.

Ejemplo

Um aplicativo recebe uma expressão matemática do usuário via URL (ex: ?calc=2+2) e executa eval(request.param('calc')) para retornar o resultado. Um atacante envia ?calc=import('os').system('rm -rf /') e consegue executar comandos no servidor.

Cómo mitigar

Nunca use eval(), exec() ou equivalentes com entrada do usuário. Se precisa avaliar expressões, use parsers seguros ou bibliotecas de sandboxing. Valide e escape rigorosamente qualquer dado dinâmico; melhor ainda: redesenhe para evitar código dinâmico completamente.

CVE-2026-50733HIGHMarkdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()EPSS 0.5%CVE-2026-45406CRITICALDokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through evalEPSS 0.5%CVE-2026-14380HIGHDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced ProfileEPSS 0.5%CVE-2026-74899CRITICALopenssl_encrypt before 1.4.0 Sandbox Escape via Type HierarchyEPSS 0.5%CVE-2026-48317CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)EPSS 0.5%CVE-2025-26845CRITICALAn Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a EPSS 0.5%CVE-2026-23885MEDIUMAlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperEPSS 0.5%CVE-2026-71865CRITICALOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cliEPSS 0.5%CVE-2011-10033CRITICALWordPress Plugin is-human <= v1.4.2 Eval Injection RCEEPSS 0.5%CVE-2026-71866CRITICALOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientEPSS 0.5%CVE-2026-44643CRITICALAngular Expressions - Remote Code Execution using filtersEPSS 0.5%CVE-2026-28505HIGHTautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist checkEPSS 0.5%CVE-2026-13048HIGHData::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filenameEPSS 0.5%CVE-2026-4851CRITICALGRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserializationEPSS 0.5%CVE-2026-79678HIGHFreeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of serviceEPSS 0.5%CVE-2025-40943CRITICALAffected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineeringEPSS 0.5%CVE-2024-32649MEDIUMvyper performs double eval of the argument of sqrtEPSS 0.5%CVE-2024-32647MEDIUMvyper performs double eval of raw_args in create_from_blueprintEPSS 0.5%CVE-2025-15551MEDIUMLAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845NEPSS 0.4%CVE-2026-45579CRITICALDIRAC: RCE in RequestManager due to eval on untrusted inputEPSS 0.4%