Improper Neutralization of Directives in Dynamically Evaluated Code
CWE-95
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).
We track 182 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 4 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: If possible, refactor your code so that it does not need to use eval() at all.
- Implementation: For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures, so the python documentation discourages use of ast.literal_eval() on untrusted data.
Latest Improper Neutralization of Directives in Dynamically Evaluated Code vulnerabilities
- 9.9 Critical severity
WilderForge: Improper Control of Generation of Code
WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of `${{ github.event.review.body }}` and other user controlled variables dire
- 9.8 Critical severity
Znuny: Improper Control of Generation of Code
An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by the user running the backup.pl script.
- 9.0 Critical severity
Amplify Studio: Improper Neutralization of Directives in Dynamically Evaluated Code
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code duri
- 9.1 Critical severity
application-confluence-migrator-pro: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. T
- 9.8 Critical severity
XWiki Platform Eval Injection Exploited
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of th
- 9.3 Critical severity
DocsGPT: Improper Neutralization of Directives in Dynamically Evaluated Code
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affec
- 7.3 High severity
Quiz Maker Developer: Improper Neutralization of Directives in Dynamically Evaluated Code
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). Thi
- 9.1 Critical severity
W3SPEEDSTER: Improper Neutralization of Directives in Dynamically Evaluated Code
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). Th
- 7.8 High severity
guardrails: Improper Neutralization of Directives in Dynamically Evaluated Code
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be
- 8.8 High severity
mindsdb: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used
- 8.8 High severity
mindsdb: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used
- 8.8 High severity
mindsdb: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used
- 8.8 High severity
mindsdb: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database crea
- 8.8 High severity
mindsdb: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database c
- 8.8 High severity
mindsdb: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a databa
- 7.8 High severity
autolabel: Improper Neutralization of Formula Elements in a CSV File
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciousl
- 7.8 High severity
autolabel: Improper Neutralization of Formula Elements in a CSV File
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV f
- 9.8 Critical severity
App Market: Improper Neutralization of Directives in Dynamically Evaluated Code
A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.
- 9.8 Critical severity
SPIP: Improper Neutralization of Directives in Dynamically Evaluated Code
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
- 9.8 Critical severity
MEGABOT: Improper Control of Generation of Code
MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python cod
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSugges
- 9.8 Critical severity
calculator-boilerplate: Improper Neutralization of Directives in Dynamically Evaluated Code
calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the input field.
- 9.8 Critical severity
geotools: Improper Neutralization of Directives in Dynamically Evaluated Code
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by use
- 9.8 Critical severity
OSGeo GeoServer GeoTools Eval Injection Exploited
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted i
- 8.8 High severity
Custom Field Suite: Improper Control of Generation of Code
The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is due to insufficient sanitization of input prior to being used in a call to the eval() function. This
- 9.8 Critical severity
xwiki-commons: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape `{`, which, when used in certain places, allows XWiki syntax inj
- 8.8 High severity
xwiki-platform: Cross-Site Request Forgery
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special crafted documented reference and an `XWiki.SchedulerJobClass` XObject, it is possible to execute arb
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in
- 9.8 Critical severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visito
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass`
- 7.8 High severity
OpenVPN Connect: Improper Neutralization of Directives in Dynamically Evaluated Code
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
- 8.1 High severity
pillow: Improper Control of Generation of Code
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
- 9.8 Critical severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code
- 7.8 High severity
OpenVPN Connect: Improper Control of Generation of Code
OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable
- 7.8 High severity
Spreadsheet::ParseExcel Remote Code Execution Exploited
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, t
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the co
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of X
- 9.8 Critical severity
fastbots: Improper Control of Generation of Code
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and i
- 9.8 Critical severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read acc
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros