Fix it in your stack

Tested fixes for CWE-95 in Express, Flask, Spring Boot, ASP.NET Core and FastAPI: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.

Definition

MITRE’s description of CWE-95: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Common consequences MITRE lists

  • Confidentiality: Read Files or Directories; Read Application Data
  • Access Control: Bypass Protection Mechanism
  • Access Control: Gain Privileges or Assume Identity
  • Integrity, Confidentiality, Availability, Other: Execute Unauthorized Code or Commands
  • Non-Repudiation: Hide Activities

Why it matters

The evaluated string runs with the application’s privileges, so any input that reaches it is remote code execution.

How to prevent it

  • Remove eval, new Function, string setTimeout, exec and compile from request paths.
  • Parse data with JSON.parse or json.loads, and formulas with a parser that allows only the operations you mean.
  • Do not rely on restricted globals or node:vm as a sandbox; isolate untrusted code in a separate process or container.

Guides on this site

Main subject · Guide

Keep untrusted input out of eval, expression languages and templates

Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.

Cites this weakness · Guide

Prevent DOM XSS, postMessage abuse and client-side injection

Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.

Cites this weakness · Guide

Harden GitHub Actions against workflow and supply-chain attacks

Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.

Practice

References

  1. CWE-95 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.