CWE-95: Eval Injection
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Also known as Improper Neutralization of Directives in Dynamically Evaluated Code.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- pymodaq, pymodaq data, gui +1 more +3 more PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files 8.5 High
- h5io h5io before 0.2.6 Arbitrary Code Execution via read_hdf5 8.5 High
- seppmail ag secure email gateway (seg) Code execution through double evaluation in address replacement rules 9.2 Critical
- chamilo chamilo-lms Chamilo LMS: Conditional PHP execution through vendored QuickForm eval 6.6 Medium
-
libspreadsheet-xlsx-perlDebian,perl-Spreadsheet-XLSXopenSUSE +1 more Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt 9.8 Critical - unclecode crawl4ai Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for 5.3 Medium
- progress software ws ftp server Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server 6.6 Medium
- No product listed JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval 8.4 High
- thu-mig yoloe THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection 4.8 Medium
- rachelos we-mp-rss WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint 9.3 Critical
- sgl-project sglang SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter 9.2 Critical
- ultralytics fastsam Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection 4.8 Medium
- imprintlab medical-sam-adapter ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection 2.4 Low
- dokku Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS 9.0 Critical
- nvidia isaac lab NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A... 7.8 High
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 more Affected devices do not properly restrict executable content contained in imported trace files. ... 9.4 Critical
- iflytek astron-agent Astron Agent: Unsandboxed code-node leads to cross-tenant RCE 9.9 Critical
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 more Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to... 8.6 High
- taskcluster Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`) 8.7 High
- shopify tophat, toptech systems tms7 +1 more Toptech TMS7 and TopHAT Eval Injection 2.1 Low
- phpcsstandards phpcsutils PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() 8.6 High
- open source robotics foundation robot operating system 2 (ros 2) Unsafe use of eval() method in ros2 topic hz tool 8.6 High
- langflow-ai langflow Langflow Code Execution via eval() in Component Input Schema 2.1 Low
- progressive robot ltd hmailserver Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer 9.8 Critical
- project-monai monai MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains 7.3 High
- project-monai monai MONAI through 1.6.0 Remote Code Execution via bundle configuration 8.5 High
- plone plone.app.portlets plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection 9.9 Critical
- sap se fiori launchpad Information Disclosure vulnerability in SAP Fiori Launchpad 5.3 Medium
- No product listed An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib... 9.8 Critical
- xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue 9.9 Critical
- redocly redocly-cli Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect` 7.8 High
- koha Koha Eval Code Injection Remote Code Execution Vulnerability 8.8 High
- contec conprosys hmi system(chs) An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue... 8.7 High
- apache camel, apache software foundation camel k +1 more Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod 9.8 Critical
- okta access gateway Improper Input Handling in Okta Access Gateway Management Console Exception Handler 6.6 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 more ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) 8.6 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 more ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) 9.9 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 more Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service 8.1 High
- n8n n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement 7.2 High
- cpanel Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute... 8.7 High
- ibm langflow oss, langflow +1 more Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement 9.9 Critical
- senaite senaite.core SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core 9.8 Critical
- google langfun Eval Injection in google/langfun via default lf.query protocol 9.2 Critical
- chirpmyradio chirp chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in... 7.8 High
- xorbits inference Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing 10.0 Critical
- aws athena federated query neptune connector Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector 9.4 Critical
- cgauge @cgauge/yaml @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag 8.4 High
- orval-labs orval Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator 9.3 Critical
- orval-labs orval Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli 9.3 Critical
- orval-labs orval Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client 9.3 Critical
- Show olderLoading…