What is CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')?+
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
What are the security consequences of Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')?+
If exploited, CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')) it can compromise Confidentiality, Access Control, Integrity, Availability, Other and Non-Repudiation, leading to outcomes such as Read Files or Directories, Read Application Data, Bypass Protection Mechanism, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands and Hide Activities.
How do you prevent or mitigate Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')?+
Recommended mitigations for CWE-95 include: If possible, refactor your code so that it does not need to use eval() at all. Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180, CWE-181). Make sure that your application does not inadvertently decode the same input twice (CWE-174). Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked. Use libraries such as the OWASP ESAPI Canonicalization control. Consider performing repeated canonicalization until your input does not change any more. This will avoid double-decoding and similar scenarios, but it might inadvertently modify inputs that are allowed to contain properly-encoded dangerous content. For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
Which programming languages are affected by Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')?+
CWE-95 commonly affects Java, JavaScript, Python, Perl, PHP, Ruby and Interpreted. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')?+
MITRE documents real CVEs mapped to CWE-95, including CVE-2024-4181, CVE-2022-2054, CVE-2021-22204, CVE-2021-22205 and CVE-2008-5071. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-95 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.