CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8342 vulnerabilities reference this CWE, most recent first.
GHSA-9HP2-7776-GVJ8
Vulnerability from github – Published: 2022-05-02 06:19 – Updated: 2022-05-02 06:19Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long exception string in a throw statement, possibly a related issue to CVE-2009-1514.
{
"affected": [],
"aliases": [
"CVE-2010-1180"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-03-29T19:30:00Z",
"severity": "HIGH"
},
"details": "Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long exception string in a throw statement, possibly a related issue to CVE-2009-1514.",
"id": "GHSA-9hp2-7776-gvj8",
"modified": "2022-05-02T06:19:53Z",
"published": "2022-05-02T06:19:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1180"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57992"
},
{
"type": "WEB",
"url": "http://nishantdaspatnaik.yolasite.com/ipodpoc5.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38992"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9HP3-F5G8-RCCG
Vulnerability from github – Published: 2025-08-27 15:33 – Updated: 2025-08-27 18:10Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "solspace/craft-freeform"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.10.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-52122"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-27T18:10:27Z",
"nvd_published_at": "2025-08-27T15:15:39Z",
"severity": "CRITICAL"
},
"details": "Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).",
"id": "GHSA-9hp3-f5g8-rccg",
"modified": "2025-08-27T18:10:27Z",
"published": "2025-08-27T15:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52122"
},
{
"type": "WEB",
"url": "https://github.com/TimTrademark/CVE-2025-52122"
},
{
"type": "WEB",
"url": "https://github.com/TimTrademark/CVE-CraftCMS-Freeform"
},
{
"type": "PACKAGE",
"url": "https://github.com/solspace/craft-freeform"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability"
}
GHSA-9HP4-PHW8-8RQ6
Vulnerability from github – Published: 2022-05-02 03:17 – Updated: 2022-05-02 03:17Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.
{
"affected": [],
"aliases": [
"CVE-2009-0625"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-02-26T16:17:00Z",
"severity": "HIGH"
},
"details": "Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.",
"id": "GHSA-9hp4-phw8-8rq6",
"modified": "2022-05-02T03:17:02Z",
"published": "2022-05-02T03:17:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0625"
},
{
"type": "WEB",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/33900"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021769"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9HQ8-HVQW-5H33
Vulnerability from github – Published: 2022-05-17 04:43 – Updated: 2022-05-17 04:43IZArc 4.1.8 displays a file's name on the basis of a ZIP archive's Central Directory entry, but launches this file on the basis of a ZIP archive's local file header, which allows user-assisted remote attackers to conduct file-extension spoofing attacks via a modified Central Directory, as demonstrated by unintended code execution prompted by a .jpg extension in the Central Directory and a .exe extension in the local file header.
{
"affected": [],
"aliases": [
"CVE-2014-2720"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-05-27T11:15:00Z",
"severity": "MODERATE"
},
"details": "IZArc 4.1.8 displays a file\u0027s name on the basis of a ZIP archive\u0027s Central Directory entry, but launches this file on the basis of a ZIP archive\u0027s local file header, which allows user-assisted remote attackers to conduct file-extension spoofing attacks via a modified Central Directory, as demonstrated by unintended code execution prompted by a .jpg extension in the Central Directory and a .exe extension in the local file header.",
"id": "GHSA-9hq8-hvqw-5h33",
"modified": "2022-05-17T04:43:11Z",
"published": "2022-05-17T04:43:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2720"
},
{
"type": "WEB",
"url": "http://www.xchg.info/?p=418"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9HR4-7JQW-C29Q
Vulnerability from github – Published: 2023-12-29 09:30 – Updated: 2026-04-28 21:33Improper Control of Generation of Code ('Code Injection') vulnerability in Milan Dinić Rename Media Files.This issue affects Rename Media Files: from n/a through 1.0.1.
{
"affected": [],
"aliases": [
"CVE-2023-32095"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-29T09:15:08Z",
"severity": "CRITICAL"
},
"details": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Milan Dini\u0107 Rename Media Files.This issue affects Rename Media Files: from n/a through 1.0.1.",
"id": "GHSA-9hr4-7jqw-c29q",
"modified": "2026-04-28T21:33:37Z",
"published": "2023-12-29T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32095"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/rename-media-files/wordpress-rename-media-files-plugin-1-0-1-remote-code-execution-rce-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9J49-MFVP-VMHM
Vulnerability from github – Published: 2021-09-02 17:10 – Updated: 2021-08-25 19:28This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "pac-resolver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "degenerator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23406"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-25T19:28:31Z",
"nvd_published_at": "2021-08-24T08:15:00Z",
"severity": "HIGH"
},
"details": "This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.",
"id": "GHSA-9j49-mfvp-vmhm",
"modified": "2021-08-25T19:28:31Z",
"published": "2021-09-02T17:10:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23406"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/node-degenerator/commit/9d25bb67d957bc2e5425fea7bf7a58b3fc64ff9e"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/node-degenerator/commit/ccc3445354135398b6eb1a04c7d27c13b833f2d5"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/node-pac-resolver/releases/tag/5.0.0"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Code Injection in pac-resolver"
}
GHSA-9J55-52G8-H6R2
Vulnerability from github – Published: 2022-05-17 05:51 – Updated: 2022-05-17 05:51Multiple PHP remote file inclusion vulnerabilities in openMairie Openfoncier 2.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) action.class.php, (2) architecte.class.php, (3) avis.class.php, (4) bible.class.php, and (5) blocnote.class.php in obj/.
{
"affected": [],
"aliases": [
"CVE-2010-1945"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-05-19T12:07:00Z",
"severity": "MODERATE"
},
"details": "Multiple PHP remote file inclusion vulnerabilities in openMairie Openfoncier 2.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) action.class.php, (2) architecte.class.php, (3) avis.class.php, (4) bible.class.php, and (5) blocnote.class.php in obj/.",
"id": "GHSA-9j55-52g8-h6r2",
"modified": "2022-05-17T05:51:07Z",
"published": "2022-05-17T05:51:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1945"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/1004-exploits/openfoncier-rfilfi.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/39607"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/12366"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/64196"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/64197"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/64198"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/64199"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/64200"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9J66-49WF-HG9G
Vulnerability from github – Published: 2022-05-01 23:55 – Updated: 2022-05-01 23:55Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the ourlinux_root_path parameter to (1) adodb-errorpear.inc.php and (2) adodb-pear.inc.php in adodb/.
{
"affected": [],
"aliases": [
"CVE-2008-2986"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-07-02T17:14:00Z",
"severity": "HIGH"
},
"details": "Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the ourlinux_root_path parameter to (1) adodb-errorpear.inc.php and (2) adodb-pear.inc.php in adodb/.",
"id": "GHSA-9j66-49wf-hg9g",
"modified": "2022-05-01T23:55:26Z",
"published": "2022-05-01T23:55:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2986"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43253"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/5897"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29880"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9J6X-9J4R-7C2J
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial '><script type="text/javascript" src=' line. Fix released on 2018-03-29.
{
"affected": [],
"aliases": [
"CVE-2018-9113"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-26T06:29:00Z",
"severity": "HIGH"
},
"details": "Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial \u0027\u003e\u003cscript type=\"text/javascript\" src=\u0027 line. Fix released on 2018-03-29.",
"id": "GHSA-9j6x-9j4r-7c2j",
"modified": "2022-05-13T01:27:32Z",
"published": "2022-05-13T01:27:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9113"
},
{
"type": "WEB",
"url": "https://github.com/CDCgov/MicrobeTrace/commit/e60c5fefb1b4740d42d99b634d3d3c4e66290f01"
},
{
"type": "WEB",
"url": "https://github.com/CDCgov/MicrobeTRACE/releases/tag/v0.1.12"
},
{
"type": "WEB",
"url": "https://github.com/wshepherd0010/advisories/blob/master/CVE-2018-9113.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9J98-C4PQ-WVQJ
Vulnerability from github – Published: 2022-05-24 17:24 – Updated: 2022-05-24 17:24A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability could be locally exploited to allow arbitrary code execution during the boot process. Note: This vulnerability is related to using insmod in GRUB2 in the specific impacted HPE product and HPE is addressing this issue. HPE has made the following software updates and mitigation information to resolve the vulnerability in Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. HPE provided latest Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting Toolkit which includes the GRUB2 patch to resolve this vulnerability. These new boot images will update GRUB2 and the Forbidden Signature Database (DBX). After the DBX is updated, users will not be able to boot to the older IP, SPP or Scripting ToolKit with Secure Boot enabled. HPE have provided a standalone DBX update tool to work with Microsoft Windows, and supported Linux Operating Systems. These tools can be used to update the Forbidden Signature Database (DBX) from within the OS. Note: This DBX update mitigates the GRUB2 issue with insmod enabled, and the "Boot Hole" issue for HPE signed GRUB2 applications.
{
"affected": [],
"aliases": [
"CVE-2020-7205"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-30T18:15:00Z",
"severity": "HIGH"
},
"details": "A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability could be locally exploited to allow arbitrary code execution during the boot process. **Note:** This vulnerability is related to using insmod in GRUB2 in the specific impacted HPE product and HPE is addressing this issue. HPE has made the following software updates and mitigation information to resolve the vulnerability in Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. HPE provided latest Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting Toolkit which includes the GRUB2 patch to resolve this vulnerability. These new boot images will update GRUB2 and the Forbidden Signature Database (DBX). After the DBX is updated, users will not be able to boot to the older IP, SPP or Scripting ToolKit with Secure Boot enabled. HPE have provided a standalone DBX update tool to work with Microsoft Windows, and supported Linux Operating Systems. These tools can be used to update the Forbidden Signature Database (DBX) from within the OS. **Note:** This DBX update mitigates the GRUB2 issue with insmod enabled, and the \"Boot Hole\" issue for HPE signed GRUB2 applications.",
"id": "GHSA-9j98-c4pq-wvqj",
"modified": "2022-05-24T17:24:45Z",
"published": "2022-05-24T17:24:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7205"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf04020en_us"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.