Falhas do tipo CWE-95

196 resultados

Injeção em Código Avaliado Dinamicamente

Ocorre quando a aplicação passa dados não validados para funções que executam código dinamicamente (como eval(), exec() ou similar), permitindo que um atacante injete e execute comandos arbitrários. O risco é crítico porque a execução é feita com os mesmos privilégios da aplicação, podendo resultar em comprometimento total do sistema.

Exemplo

Um formulário web que avalia expressões matemáticas usando eval(input_usuario) sem sanitização. Um atacante envia 'import os; os.system("rm -rf /")' em vez de uma expressão legítima, e o servidor executa o comando malicioso diretamente.

Como mitigar

Nunca use eval() ou funções equivalentes com entrada do usuário. Use parsers específicos do domínio (para expressões matemáticas, por exemplo) ou whitelist rigorosa de caracteres permitidos. Se absolutamente necessário avaliar código, isole a execução em um sandbox com permissões mínimas e valide/sanitize agressivamente antes de qualquer avaliação.

CVE-2026-50733HIGHMarkdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()EPSS 0.5%CVE-2026-45406CRITICALDokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through evalEPSS 0.5%CVE-2026-14380HIGHDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced ProfileEPSS 0.5%CVE-2026-74899CRITICALopenssl_encrypt before 1.4.0 Sandbox Escape via Type HierarchyEPSS 0.5%CVE-2026-48317CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)EPSS 0.5%CVE-2025-26845CRITICALAn Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a EPSS 0.5%CVE-2026-23885MEDIUMAlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperEPSS 0.5%CVE-2011-10033CRITICALWordPress Plugin is-human <= v1.4.2 Eval Injection RCEEPSS 0.5%CVE-2026-71866CRITICALOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientEPSS 0.5%CVE-2026-71865CRITICALOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cliEPSS 0.5%CVE-2026-28505HIGHTautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist checkEPSS 0.5%CVE-2026-44643CRITICALAngular Expressions - Remote Code Execution using filtersEPSS 0.5%CVE-2026-13048HIGHData::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filenameEPSS 0.5%CVE-2026-4851CRITICALGRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserializationEPSS 0.5%CVE-2026-79678HIGHFreeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of serviceEPSS 0.5%CVE-2025-40943CRITICALAffected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineeringEPSS 0.5%CVE-2024-32647MEDIUMvyper performs double eval of raw_args in create_from_blueprintEPSS 0.5%CVE-2024-32649MEDIUMvyper performs double eval of the argument of sqrtEPSS 0.5%CVE-2025-15551MEDIUMLAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845NEPSS 0.4%CVE-2026-45579CRITICALDIRAC: RCE in RequestManager due to eval on untrusted inputEPSS 0.4%