Improper Neutralization of Directives in Statically Saved Code
CWE-96
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Perform proper output validation and escaping to neutralize all code syntax from data written to code files.
Latest Improper Neutralization of Directives in Statically Saved Code vulnerabilities
- 7.2 High severity
Red Hat Ansible Automation Platform 2.7: Improper Neutralization of Directives in Statically Saved Code
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD
- 8.7 High severity
Plesk extension "Ruby": Improper Neutralization of Directives in Statically Saved Code
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
- 9.8 Critical severity
N-able N-central Static Code Injection Exploited
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
- 8.8 High severity
File Station 5: Improper Neutralization of Directives in Statically Saved Code
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data /
- 7.2 High severity
Unisphere for PowerMax vApp: Improper Neutralization of Directives in Statically Saved Code
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerabili
- 9.4 Critical severity
MoxieManager PHP: Improper Neutralization of Directives in Statically Saved Code
In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.ph
- 7.5 High severity
Opigno TinCan Question Type: Improper Neutralization of Directives in Statically Saved Code
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
- 7.5 High severity
Opigno Learning path: Improper Neutralization of Directives in Statically Saved Code
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
- 9.8 Critical severity
Opigno module: Improper Neutralization of Directives in Statically Saved Code
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This com
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the ser
- 8.6 High severity
less: Improper Neutralization of Directives in Statically Saved Code
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted arch
- 8.8 High severity
Pentaho Business Analytics Server: Improper Control of Generation of Code
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.