Improper Neutralization of Directives in Dynamically Evaluated Code
CWE-95
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).
We track 182 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 4 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: If possible, refactor your code so that it does not need to use eval() at all.
- Implementation: For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures, so the python documentation discourages use of ast.literal_eval() on untrusted data.
Latest Improper Neutralization of Directives in Dynamically Evaluated Code vulnerabilities
- 9.4 Critical severity
groupoffice: Improper Control of Generation of Code
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is pas
- 9.5 Critical severity
otterdog: Improper Neutralization of Directives in Dynamically Evaluated Code
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely,
- 7.8 High severity
PyMoDAQ: Improper Neutralization of Directives in Dynamically Evaluated Code
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by
- 7.8 High severity
h5io: Improper Neutralization of Directives in Dynamically Evaluated Code
h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with bui
- 9.2 Critical severity
SEPPmail Secure Email Gateway (SEG): Improper Neutralization of Directives in Dynamically Evaluated Code
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context wh
- 9.9 Critical severity
xwiki-pro-macros: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's r
- 9.8 Critical severity
we-mp-rss: Improper Neutralization of Directives in Dynamically Evaluated Code
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expres
- 8.1 High severity
sglang: Improper Neutralization of Directives in Dynamically Evaluated Code
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the u
- 9.0 Critical severity
dokku: Improper Neutralization of Directives in Dynamically Evaluated Code
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are
- 7.8 High severity
Isaac Lab: Improper Neutralization of Directives in Dynamically Evaluated Code
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Directives in Dynamically Evaluated Code
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Su
- 8.6 High severity
PHPCSUtils: Improper Neutralization of Directives in Dynamically Evaluated Code
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callb
- 9.9 Critical severity
astron-agent: Improper Neutralization of Directives in Dynamically Evaluated Code
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.
- 8.0 High severity
Brocade Active Support Connectivity Gateway: Improper Neutralization of Directives in Dynamically Evaluated Code
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply cr
- 8.7 High severity
Taskcluster is the task execution framework that supports Mozilla's continuous integration and…
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the Grap
- 8.4 High severity
Robot Operating System 2 (ROS 2): Improper Control of Generation of Code
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the
- 9.8 Critical severity
hMailServer: Improper Neutralization of Directives in Dynamically Evaluated Code
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privilege
- 8.8 High severity
MONAI: Improper Neutralization of Directives in Dynamically Evaluated Code
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p'
- 7.8 High severity
MONAI: Improper Neutralization of Directives in Dynamically Evaluated Code
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malic
- 9.9 Critical severity
plone.app.portlets: Improper Neutralization of Directives in Dynamically Evaluated Code
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portlet
- 9.9 Critical severity
xwiki-rendering: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document ca
- 7.8 High severity
redocly-cli: Improper Control of Generation of Code
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted express
- 9.9 Critical severity
DIRAC: Improper Neutralization of Special Elements used in an SQL Command
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetMa
- 9.9 Critical severity
DIRAC: Improper Neutralization of Directives in Dynamically Evaluated Code
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlle
- 8.8 High severity
Koha: Improper Neutralization of Directives in Dynamically Evaluated Code
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the
- 8.8 High severity
CONPROSYS HMI System(CHS): Improper Neutralization of Directives in Dynamically Evaluated Code
An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). If exploited, arbitrary code may be executed by an attacker who can log in to the product.
- 9.8 Critical severity
Apache Camel K: Improper Neutralization of Directives in Dynamically Evaluated Code
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influen
- 7.2 High severity
Okta Access Gateway: Improper Neutralization of Directives in Dynamically Evaluated Code
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of th
- 8.6 High severity
ColdFusion 2025: Improper Neutralization of Directives in Dynamically Evaluated Code
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to
- 9.9 Critical severity
ColdFusion 2025: Improper Neutralization of Directives in Dynamically Evaluated Code
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vul
- 8.1 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Directives in Dynamically Evaluated Code
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardl
- 9.9 Critical severity
n8n: Improper Neutralization of Directives in Dynamically Evaluated Code
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutat
- 9.9 Critical severity
Langflow OSS: Improper Neutralization of Directives in Dynamically Evaluated Code
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allow
- 9.8 Critical severity
senaite.core: Improper Neutralization of Directives in Dynamically Evaluated Code
SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe eva
- 9.2 Critical severity
langfun: Improper Neutralization of Directives in Dynamically Evaluated Code
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of
- 10.0 Critical severity
inference: Improper Neutralization of Directives in Dynamically Evaluated Code
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model
- 9.9 Critical severity
Athena Federated Query Neptune Connector: Improper Neutralization of Directives in Dynamically Evaluated Code
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.
- 7.8 High severity
@cgauge/yaml: Improper Neutralization of Directives in Dynamically Evaluated Code
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during
- 9.3 Critical severity
orval: Improper Neutralization of Special Elements used in an SQL Command
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding.
- 9.3 Critical severity
orval: Improper Neutralization of Special Elements used in an SQL Command
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. T