Home/CWE/Improper Control of Generation of Code ('Code Injection')
Weakness

Improper Control of Generation of Code ('Code Injection')

CWE-94 · Base · Draft

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
ChildOfCWE-913 · Improper Control of Dynamically-Managed Code Resources
Children (more specific)
ParentOfCWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
ParentOfCWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
ParentOfCWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
◆

Attack Patterns (CAPEC)

3
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-242Code Injection
CAPEC-35Leverage Executable Code in Non-Executable Files
CAPEC-77Manipulating User-Controlled Variables
⚠

CVEs With This Weakness

6,717
A sample of the 6,717 CVEs tagged with this weakness.
CVECVE-2026-8838
CVECVE-2026-8634
CVECVE-2026-8539
CVECVE-2026-8430
CVECVE-2026-8429
CVECVE-2026-8262
CVECVE-2026-8256
CVECVE-2026-8255
CVECVE-2026-8254
CVECVE-2026-8253
CVECVE-2026-8221
CVECVE-2026-8220
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalDbGate Web Client - Unauthenticated Remote Command Execution
criticalSeeyon OA Fastjson Remote Code Execution
criticalThinkCMF - Remote Code Execution
criticalJoomla! CMS <=3.4.6 - Remote Code Execution
criticalDahua 'GetClassValue' - Remote Code Execution
criticalJolokia file write to RCE jfr
criticalWeaver OA Workrelate - Arbitary File Upload
criticalWordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload
criticalApache Solr 7+ - Remote Code Execution (Apache Log4j)
criticalApache Flink - Remote Code Execution
criticalApache Solr 9.1 - Remote Code Execution
criticalDedeCMS 5.8.1-beta - Remote Code Execution
criticalPHP 8.1.0-dev - Backdoor Remote Code Execution
criticalJenkins - Remote Code Execution
criticalSpring Boot H2 Database - Remote Command Execution
criticalHIKVISION applyCT Fastjson - Remote Command Execution
criticalDataEase 2.10.4-2.10.7 - Remote Code Execution
criticalDELMIA Apriso - Command Injection
criticalXWiki <= 17.3.0 - Server-Side Template Injection (SSTI)
criticalFoxCMS v.1.2.5 - Remote Code Execution
criticalMongoose - NoSQL Injection
criticaln8n - Remote Code Execution via Expression Injection
criticalAdvanced Custom Fields Extended < 0.9.2 - Remote Code Execution
criticalCraftCMS - Remote Code Execution
criticalTandoor Recipes < 1.5.24 - Jinja2 SSTI RCE
criticalJSONPath Plus < 10.3.0 - Remote Code Execution
criticalSpring Cloud Gateway Server Webflux - Broken Access Control
criticalFlowise - Remote Code Execution
criticalSPIP Saisies - Remote Code Execution
criticalAPsystems ECU-R Firmware - Command Injection
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin