An application uses 'eval(userInput)' in a Node.js API endpoint to process mathematical expressions. An attacker submits 'require("child_process").execSync("id")'. What OWASP category does this represent?

• A.A08 Software and Data Integrity Failures - specifically insecure deserialization (the endpoint rebuilds objects from untrusted data): the math expression is parsed into an object graph since the runtime executes it during unpacking
• B.A03 Injection - specifically code injection/Remote Code Execution via eval(): the application passes untrusted input to an interpreter (Node.js's eval) which treats it as code and executes it with the process's full privileges
• C.A04 Insecure Design - specifically an unsafe feature choice (a calculator built on a general-purpose evaluator): the threat model should have required a dedicated expression parser and a sandbox but the team skipped the sandbox
• D.A06 Vulnerable and Outdated Components - specifically a risky runtime (an old Node.js build with a known eval flaw): upgrading the interpreter and removing the endpoint closes the exposure since the flaw lives in the runtime build and not in the application code