CWE-95

Medium likelihood

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Parent: CWE-94 - Improper Control of Generation of Code ('Code Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

152 vulnerabilities with CWE-95
CVE-2026-55415 HIGH
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
CVSS 7.5
CVE-2026-45293 HIGH
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
CVSS 8.6
CVE-2026-61511 CRITICAL
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
CVSS 9.8
CVE-2026-47391 CRITICAL
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
CVSS 9.8
CVE-2026-64193 CRITICAL
Net::DNS <= 1.55 - Command Execution via EDNS Extended Error Eval Injection
CVSS 9.8
CVE-2026-40187 HIGH
Authenticated RCE via Malicious eTemplate Upload in EGroupware
CVE-2026-46562 CRITICAL
Yamcs: Remote Code Execution via Mission Database algorithm override
CVSS 9.8
CVE-2026-14380 HIGH
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
CVSS 8.8
CVE-2026-45406 CRITICAL
Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
CVSS 9.0
CVE-2026-44939 CRITICAL
Command injection through unsanitized YAML parameter in Rancher
CVE-2026-53875 HIGH
picklescan - Scanning Bypass via Dynamic Eval in scan_pytorch
CVE-2026-47103 CRITICAL
Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection
CVSS 9.8
CVE-2026-52858 HIGH
Vim: Arbitrary Code Execution via Python Omni-Completion
CVSS 7.8
CVE-2026-47167 MEDIUM
Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
CVSS 5.3
CVE-2026-11422 HIGH
Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering
CVSS 7.1
CVE-2026-50733 HIGH
Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()
CVSS 8.8
CVE-2026-8914 HIGH
Teltonika Networks RUTOS - Command Injection in Profile Change Function
CVE-2026-48962 HIGH
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob
CVSS 7.3
CVE-2026-46586 HIGH
Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution
CVSS 8.8
CVE-2026-42603 HIGH
OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target
CVSS 8.8
CVE-2026-31254 HIGH
flash-attention thru e724e2588 - Code Injection
CVSS 7.3
CVE-2026-44643 CRITICAL
Angular Expressions - Remote Code Execution using filters
CVSS 10.0
CVE-2026-44128 CRITICAL
SEPPmail Secure Email Gateway < 15.0.2.1 - Unauthenticated Remote Code Execution via Perl Eval Injection
CVE-2026-42079 HIGH
PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope
CVSS 8.6
CVE-2026-6652 MEDIUM
Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection
CVSS 4.7
Details
Vulnerabilities 152
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits