Tested fixes for CWE-94 in Express, Flask, Spring Boot, ASP.NET Core and FastAPI: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-94: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Common consequences MITRE lists
- Access Control: Bypass Protection Mechanism
- Access Control: Gain Privileges or Assume Identity
- Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
- Non-Repudiation: Hide Activities
If input is evaluated as code, through eval, expression languages or template compilation, the attacker’s logic runs inside the application process.
- Never pass untrusted input to
eval,Function,execor similar dynamic execution features. - Render templates with data only: never compile a template supplied by a user.
- Where users need logic, give them a constrained language with an allowlist of operations and resource limits.
- Enable static analysis rules that flag dynamic code execution.
Guides on this site
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
Keep untrusted CI work outside the release boundary
Review workflow authority, persistent state and artifact handoffs before contributor-controlled code reaches privileged jobs.
Prevent file inclusion: LFI, RFI, dynamic imports and template names
Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.
Sandbox model-generated code and computer-use agents
Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.
Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)
How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.
Case study: Spring4Shell (CVE-2022-22965)
How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.
Practice
- Actions injection lab: Flag GitHub Actions expression injection · Browser lab
- SQL injection lab: Separate SQL structure from data with sqlite3 · Browser lab
- File upload lab: Accept avatars without publishing pages · Browser lab
- OS command injection lab: Run git without a shell · Browser lab
- SSTI lab: Render a welcome banner without template injection · Browser lab
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- Parse bounded JSON and XML invoices safely · Local project
- Repair a native parser using sanitizer evidence · Local project
- Repair a security pipeline for GitHub Actions and GitLab CI · Local project
- Run model-generated Python in a locked-down container · Local project
References
- CWE-94 in the MITRE CWE list (version 4.20)
- 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program)
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.