Code injection
Untrusted input becomes code that the application evaluates or compiles, as with eval, exec, dynamic imports or expression languages (CWE-94). Never evaluate input; map it to a fixed set of operations or parse it as data.
- Also called
- eval injection
- Fix it in your stack
- Code injection fix cards (5 stacks) · Server-side template injection fix cards (4 stacks) · CWE-94 page
- Defined in
- MITRE CWE-94
- Identifiers
- CWE-94: Code injection
Covered in
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Prevent file inclusion: LFI, RFI, dynamic imports and template names
Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.
Keep untrusted CI work outside the release boundary
Review workflow authority, persistent state and artifact handoffs before contributor-controlled code reaches privileged jobs.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
Sandbox model-generated code and computer-use agents
Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.
All 9 pages that cover Code injection in the library
Practice: Actions injection lab: Flag GitHub Actions expression injection · SQL injection lab: Separate SQL structure from data with sqlite3 · File upload lab: Accept avatars without publishing pages · OS command injection lab: Run git without a shell