What MITRE CWE-94 - Improper Control of Generation of Code (Code Injection) requires
CWE-94 (Improper Control of Generation of Code, commonly known as Code Injection) is a CWE Top 25 weakness covering server-side template injection, eval injection, expression language injection, and dynamic code generation vulnerabilities. CWE-94 is defined as: the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Common Consequences include bypass protection mechanism with access control scope (injectable code may control authentication, potentially leading to remote vulnerabilities); gain privileges or assume identity (injected code can access resources that the attacker is directly prevented from accessing); execute unauthorized code or commands with integrity, confidentiality, and availability impact (when a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product); and hide activities (often the actions performed by injected control code are unlogged). Potential Mitigations include refactoring (eliminate dynamic code generation where possible); sandboxing (execute code in restricted environments using tools like chroot jails or AppArmor to limit operating system access); input validation (apply strict accept-known-good allowlists that limit acceptable constructs, particularly for function invocations); taint propagation (employ runtime systems that flag and prevent execution of tainted variables, e.g., Perl's -T switch); and alternative functions (replace dangerous functions like eval() with safer alternatives such as Python's ast.literal_eval() where feasible). CWE-94 is the parent for CWE-95 (Eval Injection), CWE-96 (Static Code Injection), CWE-913 (Improper Control of Dynamically-Managed Code Resources), and template injection variants.
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/94.html
SHA-256 integrity: d9ef3795ff29d55c384f1e73a0ef941da60fa60037e1261a5c770f6f648cbd6a
Primary Citations — 11 traced to source
- CWE-94: Improper Control of Generation of Code (Code Injection) - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/94.html
- CWE-94 Definition - the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment
+ 9 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-cwe-94-code-injection.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-cwe-94-code-injection.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-cwe-94-code-injection
- Back to registry: Browse all 10,085 compliance nodes