CWE-94 Code Injection
What this means
SiteShadow flagged a pattern where untrusted input may be interpreted and executed as code (directly or indirectly). Examples include eval, dynamic language execution, expression languages, or template engines used unsafely.
Why it matters
Code injection can lead to full system compromise.
- Remote Code Execution (RCE): attackers run arbitrary code as your service.
- Secret theft and lateral movement: environment variables, keys, and internal network access can be exfiltrated.
- Persistence: attackers can implant backdoors if they get write access.
Safer examples
1) Don't evaluate untrusted input
// Bad: eval(req.body.expr)
// Good: parse a known format instead
const n = Number.parseInt(req.body.count, 10);
if (!Number.isFinite(n)) throw new Error("Invalid count");2) Use allowlists for "dynamic" behavior
handlers = {"csv": handle_csv, "pdf": handle_pdf}
handler = handlers.get(kind)
if not handler:
raise ValueError("Unsupported kind")
handler(payload)3) Lock down template/expression features
Use frameworks that escape by default and avoid exposing expression evaluation to user-controlled strings.
How SiteShadow detects it (high level)
- Flags known dynamic execution APIs (eval/exec/expression languages) when inputs are user-controlled.
- Detects flows where untrusted strings reach code-evaluation or template execution sinks.
References
- CWE-94: https://cwe.mitre.org/data/definitions/94.html
---