Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

Code Injection vulnerabilities

CWE-94 · 12 tracked

Code injection (CWE-94) is a flaw where an application incorporates untrusted input into code that it then executes, letting an attacker run arbitrary commands or scripts.

How it’s exploited

The attacker supplies input that reaches a dynamic-execution sink (eval, template engine, or a deserializer), turning data into executed code — typically leading to full remote code execution.

How to prevent it

Never pass untrusted input to dynamic-execution functions; use safe, non-evaluating alternatives, sandbox where execution is unavoidable, and validate input against a strict schema.

Tracked code injection vulnerabilities

12 CVEs in this class, each with severity, exploit status, EPSS, and remediation.

Frequently asked questions

What is Code Injection?
Code injection (CWE-94) is a flaw where an application incorporates untrusted input into code that it then executes, letting an attacker run arbitrary commands or scripts.
How is code injection exploited?
The attacker supplies input that reaches a dynamic-execution sink (eval, template engine, or a deserializer), turning data into executed code — typically leading to full remote code execution.
How do you prevent code injection?
Never pass untrusted input to dynamic-execution functions; use safe, non-evaluating alternatives, sandbox where execution is unavoidable, and validate input against a strict schema.
How many code injection vulnerabilities are there?
O3 tracks 12 vulnerabilities classified as CWE-94 (Code Injection), each with severity, exploit status, EPSS exploitation probability, and remediation. The full list is below.