CWE Top 25 2025, rank 10CWE-94
Code Injection
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection happens when an application builds code in its own language from user input and then interprets or executes it. Unlike OS command injection, the payload is code for the application's runtime, such as PHP, Python, JavaScript, or a template language, so it runs inside the application with all of its access. Server-side template injection and unsafe use of eval are the most common modern forms.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A calculator feature passes the user's expression to eval(), so entering __import__('os').system('id') runs a command.
- A marketing tool lets users customize emails with a server-side template engine, and a payload such as {{7*7}} confirms server-side template injection that escalates to code execution.
- An expression language evaluated in a framework error page or header processes attacker input as code.
How to mitigate it
- Never pass user input to eval, exec, Function(), or equivalent dynamic code features.
- Render user-supplied templates only in a logic-less or sandboxed template engine, and never concatenate input into template source.
- Validate input against a strict grammar or allow-list when user-defined expressions are a genuine requirement.
- Run interpreters with least privilege and keep framework expression-language features disabled where they are not needed.
Go deeper
Practice this topic
Test your knowledge of Code Injection with exam-style practice questions.