An application uses 'eval(userInput)' in a Node.js API endpoint to process mathematical expressions. An attacker submits 'require("child_process").execSync("id")'. What OWASP category does this represent?

• A.A08 Software and Data Integrity Failures
• B.A03 Injection - specifically code injection/Remote Code Execution via eval(): the application passes untrusted input to an interpreter (Node.js's eval) which treats it as code and executes it with the process's full privileges
• C.A05 Security Misconfiguration; deserializing signed payloads stays safe even with a leaked key, because signatures also encrypt the embedded class names; template injection is harmless in Jinja2, which sandboxes expressions by default; least privilege applies to human accounts only, as service accounts require broad grants to remain stable
• D.A02 Cryptographic Failures