{
  "node_id": "owasp-top-10-2025-a05-injection",
  "title": "A05:2025 Injection",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-07-17",
  "bluf": "OWASP Top 10:2025 A05:2025 Injection. An injection vulnerability is an application flaw that allows untrusted user input to be sent to an interpreter (e.g. a browser, database, the command line) and causes the interpreter to execute parts of that input as commands. This category sits within the OWASP Top 10:2025 (the 2025 edition, finalized January 2026), the canonical industry list of the ten most critical web application security risks. Organizations building web applications should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category. Mapped weaknesses: CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, and others.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 11
}