CWE-94 Code Injection

Coverage: 38 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 36Other-pattern 2 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged a pattern where untrusted input may be interpreted and executed as code (directly or indirectly). Examples include eval, dynamic language execution, expression languages, or template engines used unsafely.

Why it matters

Code injection can lead to full system compromise.

• Remote Code Execution (RCE): attackers run arbitrary code as your service.
• Secret theft and lateral movement: environment variables, keys, and internal network access can be exfiltrated.
• Persistence: attackers can implant backdoors if they get write access.

Safer examples

1) Don't evaluate untrusted input

// Bad: eval(req.body.expr)
// Good: parse a known format instead
const n = Number.parseInt(req.body.count, 10);
if (!Number.isFinite(n)) throw new Error("Invalid count");

2) Use allowlists for "dynamic" behavior

handlers = {"csv": handle_csv, "pdf": handle_pdf}
handler = handlers.get(kind)
if not handler:
    raise ValueError("Unsupported kind")
handler(payload)

3) Lock down template/expression features

Use frameworks that escape by default and avoid exposing expression evaluation to user-controlled strings.

How SiteShadow detects it (high level)

• Flags known dynamic execution APIs (eval/exec/expression languages) when inputs are user-controlled.
• Detects flows where untrusted strings reach code-evaluation or template execution sinks.

References

• CWE-94: https://cwe.mitre.org/data/definitions/94.html

---

← Back to Vulnerability Library