225
An alternative, commonly-cited mitigation for this kind of weakness is to use the ast.literal_eval()
function, since it is intentionally designed to avoid executing code. However, an adversary could
still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so
the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
Observed Examples
Reference Description
CVE-2022-2054 Python compiler uses eval() to execute malicious strings as Python code.
https://www.cve.org/CVERecord?id=CVE-2022-2054
CVE-2021-22204 Chain: regex in EXIF processor code does not correctly determine where a
string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the
wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-22204
CVE-2020-8218 "Code injection" in VPN product, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-8218
CVE-2008-5071 Eval injection in PHP program.
https://www.cve.org/CVERecord?id=CVE-2008-5071
CVE-2002-1750 Eval injection in Perl program.
https://www.cve.org/CVERecord?id=CVE-2002-1750
CVE-2008-5305 Eval injection in Perl program using an ID that should only contain hyphens
and numbers.
https://www.cve.org/CVERecord?id=CVE-2008-5305
CVE-2002-1752 Direct code injection into Perl eval function.
https://www.cve.org/CVERecord?id=CVE-2002-1752
CVE-2002-1753 Eval injection in Perl program.
https://www.cve.org/CVERecord?id=CVE-2002-1753
CVE-2005-1527 Direct code injection into Perl eval function.
https://www.cve.org/CVERecord?id=CVE-2005-1527
CVE-2005-2837 Direct code injection into Perl eval function.
https://www.cve.org/CVERecord?id=CVE-2005-2837
CVE-2005-1921 MFV. code injection into PHP eval statement using nested constructs that
should not be nested.
https://www.cve.org/CVERecord?id=CVE-2005-1921
CVE-2005-2498 MFV. code injection into PHP eval statement using nested constructs that
should not be nested.
https://www.cve.org/CVERecord?id=CVE-2005-2498
CVE-2005-3302 Code injection into Python eval statement from a field in a formatted file.
https://www.cve.org/CVERecord?id=CVE-2005-3302
CVE-2007-1253 Eval injection in Python program.
https://www.cve.org/CVERecord?id=CVE-2007-1253
CVE-2001-1471 chain: Resultant eval injection. An invalid value prevents initialization of
variables, which can be modified by attacker and later injected into PHP eval
statement.
https://www.cve.org/CVERecord?id=CVE-2001-1471
CVE-2002-0495 Perl code directly injected into CGI library file from parameters to another CGI
program.
https://www.cve.org/CVERecord?id=CVE-2002-0495
CVE-2005-1876 Direct PHP code injection into supporting template file.
https://www.cve.org/CVERecord?id=CVE-2005-1876
CVE-2005-1894 Direct code injection into PHP script that can be accessed by attacker.
https://www.cve.org/CVERecord?id=CVE-2005-1894
CVE-2003-0395 PHP code from User-Agent HTTP header directly inserted into log file
implemented as PHP script.
https://www.cve.org/CVERecord?id=CVE-2003-0395
CWE Version 4.14
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-95: Improper Neutralization of Directives
in Dynamically Evaluated Code ('Eval Injection') 226
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 752 2009 Top 25 - Risky Resource Management 750 2353
MemberOf 884 CWE Cross-section 884 2567
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER CODE Code Evaluation and Injection
ISA/IEC 62443 Part 4-2 Req CR 3.5
ISA/IEC 62443 Part 3-3 Req SR 3.5
ISA/IEC 62443 Part 4-1 Req SVV-1
ISA/IEC 62443 Part 4-1 Req SVV-3
Related Attack Patterns
CAPEC-ID Attack Pattern Name
35 Leverage Executable Code in Non-Executable Files
77 Manipulating User-Controlled Variables
242 Code Injection
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1372]"How ast.literal_eval can cause memory exhaustion". 2022
December 4. Reddit. < https://www.reddit.com/r/learnpython/comments/zmbhcf/
how_astliteral_eval_can_cause_memory_exhaustion/ >.2023-11-03.
[REF-1373]"ast - Abstract Syntax Trees". 2023 November 2. Python. < https://docs.python.org/3/
library/ast.html#ast.literal_eval >.2023-11-03.
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
('Eval Injection')
Weakness ID : 95
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-95: Improper Neutralization of Directives
in Dynamically Evaluated Code ('Eval Injection')