CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- coreshopCoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration8.2 High
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab5.4 Medium
- No product listedRemote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim,...6.3 Medium
- cubecart v6CubeCart: Authenticated RCE via Invoice Template → Order Print7.2 High
- cubecart v6CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE9.1 Critical
- cubecart v6CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE9.1 Critical
- palo alto networks prisma browserPrisma Browser: Code Injection Enables Security Controls Bypass7.3 High
- cnighswonger claude-code-cache-fixclaude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh8.6 High
- mapfish mapfish-print, camptocamp mapfish print, org.mapfish print.print-lib +1 more +3 moremapfish-print: Remote Code Injection (RCE) in Dynamic table9.3 Critical
- churchcrm crmChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD10.0 Critical
- claris filemaker cloudA Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console...7.2 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- wftpserver wing ftp server, wing ftp server ftp server +1 moreWing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization8.6 High
- spipSPIP < 4.4.14 Remote Code Execution via nginx9.2 Critical
- spipSPIP < 4.4.14 Remote Code Execution via Private Space8.7 High
- antswordproject antswordAntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection8.8 High
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.1 +1 moreMicrosoft Dynamics 365 On-Premises Remote Code Execution Vulnerability9.9 Critical
- microsoft data formulatorMicrosoft Data Formulator Remote Code Execution Vulnerability8.8 High
- protobufjs protobuf.js, protobufjs project protobufjs-cli +1 moreprotobufjs-cli: Code injection in pbjs static output from crafted schema names8.7 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +20 more +22 moreprotobufjs: Code injection through bytes field defaults in generated toObject code7.7 High
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Code generation gadget after prototype pollution8.1 High
- sap se application server abap for sap netweaver and abap platformCode Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform4.3 Medium
- red hat openshift ai (rhoai)llm CLI tool contains a code injection vulnerability via `--functions` command-line argument9.8 Critical
guardrails-aiPyPIGuardrails AI contains a code injection vulnerability in its Hub package installation mechanism9.8 Critical- No product listedCognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell...9.8 Critical
- red hat openshift ai (rhoai)The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection...9.8 Critical
- red hat openshift ai (rhoai)The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution...9.8 Critical
superduper-frameworkPyPISuperduper: Remote code execution via unsafe eval in superduper query parsing8.8 HighsyftPyPIPySyft server-side arbitrary Python execution after code approval9.8 Critical- nebuly optimateThe _load_model() function in the neural_magic_training.py script of the optimate project in...9.8 Critical
kubectl-mcp-servernpmOpen Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page9.8 Critical- nyariv sandboxjsSandboxJS: Sandbox escape via Function.caller leakage of internal call op10.0 Critical
- mermaid-js mermaidMermaid: Improper sanitization of configuration leads to CSS injection5.3 Medium
- mermaid-js mermaidMermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection5.3 Medium
- mermaid-js mermaidMermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection5.3 Medium
- owasp-blt bltOWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target8.8 High
- bentomlBentoML: Dockerfile command injection via envs[*].name in bentofile.yaml8.8 High
- devs palace erp onlineDevs Palace ERP Online chart-save cross site scripting4.8 Medium
- devs palace erp onlineDevs Palace ERP Online mr-save cross site scripting4.8 Medium
- devs palace erp onlineDevs Palace ERP Online add_new_customer cross site scripting4.8 Medium
- No product listedAn issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the...7.3 High
flash-attnPyPIflash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism7.3 High- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...5.7 Medium
- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...7.3 High
- devs palace erp onlineDevs Palace ERP Online sales_save cross site scripting4.8 Medium
- devs palace erp onlineDevs Palace ERP Online purchase_save cross site scripting4.8 Medium
- evo evolution cmsEvolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation8.7 High
- impresscmsImpressCMS 1.4.2 Remote Code Execution via Autotasks8.7 High
- sentrySentry 8.2.0 Remote Code Execution via Pickle Deserialization8.7 High
- megatkc aero cmsAero CMS 0.0.1 PHP Code Injection via posts.php8.7 High
- Show moreLoading…