Improper Neutralization of Directives in Dynamically Evaluated Code
CWE-95
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).
We track 182 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 4 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: If possible, refactor your code so that it does not need to use eval() at all.
- Implementation: For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures, so the python documentation discourages use of ast.literal_eval() on untrusted data.
Latest Improper Neutralization of Directives in Dynamically Evaluated Code vulnerabilities
- 9.3 Critical severity
orval: Improper Control of Generation of Code
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding.
- 9.3 Critical severity
orval: Improper Control of Generation of Code
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding
- 7.8 High severity
FreeCAD: Improper Neutralization of Directives in Dynamically Evaluated Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrar
- 7.8 High severity
FreeCAD: Improper Neutralization of Directives in Dynamically Evaluated Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu,
- 9.8 Critical severity
openssl_encrypt: Improper Neutralization of Directives in Dynamically Evaluated Code
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to a
- 9.9 Critical severity
Security Center: Improper Neutralization of Directives in Dynamically Evaluated Code
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-si
- 9.9 Critical severity
Flowise: Improper Neutralization of Directives in Dynamically Evaluated Code
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function t
- 8.8 High severity
Flowise: Improper Neutralization of Directives in Dynamically Evaluated Code
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments.
- 8.5 High severity
calibre: Improper Control of Generation of Code
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templa
- 7.8 High severity
faker: Improper Neutralization of Directives in Dynamically Evaluated Code
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty
- 9.3 Critical severity
Fooocus: Improper Neutralization of Directives in Dynamically Evaluated Code
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute ar
- 9.3 Critical severity
firecrawl: Improper Neutralization of Special Elements used in a Command
Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/a
- 9.8 Critical severity
Flowise: Improper Control of Generation of Code
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node
- 8.8 High severity
Flowise: Improper Neutralization of Directives in Dynamically Evaluated Code
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code
- 8.8 High severity
perspective: Improper Neutralization of Directives in Dynamically Evaluated Code
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied inpu
- 9.6 Critical severity
Adobe Campaign Classic: Improper Neutralization of Directives in Dynamically Evaluated Code
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker coul
- 9.1 Critical severity
openemr: Improper Neutralization of Directives in Dynamically Evaluated Code
OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into
- 9.8 Critical severity
SGLang: Improper Neutralization of Directives in Dynamically Evaluated Code
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.
- 7.5 High severity
datamodel-code-generator: Improper Control of Generation of Code
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-py
- 8.6 High severity
WordPress-Coding-Standards: Improper Neutralization of Directives in Dynamically Evaluated Code
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the
- 9.8 Critical severity
vBulletin: Improper Neutralization of Directives in Dynamically Evaluated Code
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafte
- 7.8 High severity
ntlk: Improper Neutralization of Directives in Dynamically Evaluated Code
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly
- 9.8 Critical severity
PraisonAI: Improper Neutralization of Directives in Dynamically Evaluated Code
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds
- 9.8 Critical severity
Net::DNS: Improper Neutralization of Directives in Dynamically Evaluated Code
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the
- 8.6 High severity
egroupware: Improper Neutralization of Special Elements used in an OS Command
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widg
- 9.8 Critical severity
yamcs: Improper Control of Generation of Code
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter,
- 8.8 High severity
Dbi: Improper Neutralization of Directives in Dynamically Evaluated Code
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval
- 8.8 High severity
dokku: Improper Neutralization of Directives in Dynamically Evaluated Code
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is la
- 8.1 High severity
picklescan: Improper Neutralization of Directives in Dynamically Evaluated Code
picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().
- 9.4 Critical severity
Rancher: Improper Neutralization of Directives in Dynamically Evaluated Code
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
- 7.1 High severity
picklescan: Improper Neutralization of Directives in Dynamically Evaluated Code
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklesc
- 9.8 Critical severity
python-statemachine: Improper Control of Generation of Code
Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evaluated unsafely. The SCXM
- 7.8 High severity
vim: Improper Control of Generation of Code
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) execu
- 7.1 High severity
Markdown Preview Enhanced: Improper Neutralization of Directives in Dynamically Evaluated Code
Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within
- 8.8 High severity
Markdown Preview Enhanced: Improper Neutralization of Directives in Dynamically Evaluated Code
Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML
- 8.4 High severity
RUTOS: Improper Neutralization of Directives in Dynamically Evaluated Code
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command
- 7.8 High severity
IO::Compress: Improper Neutralization of Directives in Dynamically Evaluated Code
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() t
- 8.8 High severity
Apache OFBiz: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade
- 8.8 High severity
BLT: Improper Control of Generation of Code
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code di
- 10.0 Critical severity
angular-expressions: Improper Neutralization of Directives in Dynamically Evaluated Code
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is