CWE-95: Eval Injection
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Also known as Improper Neutralization of Directives in Dynamically Evaluated Code.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- open source robotics foundation robot operating system (ros), openrobotics robot operating system +1 moreUnsafe use of eval() method in rostopic echo tool7.8 High
- open source robotics foundation robot operating system (ros), openrobotics robot operating system +1 moreUnsafe use of eval() method in rostopic hz tool7.8 High
- open source robotics foundation robot operating system (ros), openrobotics robot operating system +1 moreUnsafe use of eval() method in roslaunch tool7.8 High
- open source robotics foundation robot operating system (ros), openrobotics robot operating system +1 moreUnsafe use of eval() method in rosparam tool7.8 High
- letta-ai lettaletta-ai letta interface.py function_message eval injection5.1 Medium
- conda-forge conda-forge-ci-setup-feedstockconda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing4.4 Medium
- wilderforgeWilderForge vulnerable to code Injection via GitHub Actions Workflows10.0 Critical
- ozi-project publishOZI-Project/ozi-publish Code Injection vulnerability6.3 Medium
- znunyAn Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the...9.8 Critical
- amazon amplify studioInput validation issue in AWS Amplify Studio UI component properties9.0 Critical
- nixos hydraHydra no restricted eval after nix-eval-jobs migration2.6 Low
- xwikisas application-confluence-migrator-proXWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations9.1 Critical
- xwiki platform, xwiki, xwiki xwiki-platform +2 moreRemote code execution as guest via SolrSearchMacros request in xwiki9.8 Critical
- arc53 docsgptRemote Code Execution in DocsGPT9.3 Critical
- ays pro plugins quiz maker business, quiz maker agency, quiz maker developer +2 moreQuiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content7.3 High
- microsoft torchgeoTorchGeo Remote Code Execution Vulnerability8.1 High
- modelscope agentscopeAgentScope uses `eval`9.8 Critical
- w3speedsterW3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution9.1 Critical
org.openrefine.dependencies:butterflyMavenButterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)No score- langchain experimental, langchain-experimental +1 moreLangChain Experimental Eval Injection vulnerability9.8 Critical
- guardrails ai guardrailsGuardrails has an arbitrary code execution vulnerability7.8 High
- chaosbladeChaosblade vulnerable to OS command execution8.6 High
- mindsdbMindsDB Eval Injection vulnerability8.8 High
- mindsdbMindsDB Eval Injection vulnerability8.8 High
- mindsdbMindsDB Eval Injection vulnerability8.8 High
- mindsdbMindsDB Eval Injection vulnerability8.8 High
- mindsdbMindsDB Eval Injection vulnerability8.8 High
- mindsdbMindsDB Eval Injection vulnerability8.8 High
- refuel autolabelRefuel Autolab Eval Injection vulnerability7.8 High
- refuel autolabelRefuel Autolab Eval Injection vulnerability7.8 High
- mi app marketXiaomi App Market has a code execution vulnerability7.6 High
- spipSPIP porte_plume Plugin Arbitrary PHP Execution9.8 Critical
- megacord megabotRemote Code Execution Vulnerability in MEGABOT9.8 Critical
- journyx, journyx (jtime) +1 moreJournyx Authenticated Remote Code Execution8.8 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet10.0 Critical
- 253153 calculator-boilerplatecalculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability...9.8 Critical
- geotoolsGeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions9.8 Critical
- geoserver, geotools +1 moreRemote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver9.8 Critical
- custom field suite project field suite, mgibbs189 custom field suite +1 moreCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field8.8 High
- vyperlang vypervyper performs double eval of the argument of sqrt5.3 Medium
- vyperlang vypervyper performs double eval of raw_args in create_from_blueprint5.3 Medium
- xwiki commons, xwiki, xwiki xwiki-commons +2 moreXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through scheduler job's document reference9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution through space title and Solr space facet10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution as guest via DatabaseSearch10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from account via SearchSuggestSourceSheet10.0 Critical
- openvpn connectThe nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not...7.8 High
- checkmkPrivilege escalation in mk_tsm8.8 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Remote Code Execution vulnerability via user registration10.0 Critical
- openvpn connectOpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external...7.8 High
- Show moreLoading…