CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

MITRE Corporation. CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection').

Type

Web resource

Intellectual base

Web

Link

https://cwe.mitre.org/data/definitions/95.html

Cited by

1 citation across 1 artifact.

Each citation links to the sentence it supports in the citing article.

Domain-specific

• Formula Calculator
  • Passing untrusted input to a general programming-language evaluator can cross the data/control boundary and execute unintended commands

    This sourceCommon Weakness Enumeration (CWE), version 4.20. MITRE's catalogue entry for eval injection, which defines the failure as unneutralized upstream input reaching a dynamic evaluation call and lists unauthorized code or command execution as its consequence.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:cc06f6f00826 · see in the full table