Cyber Resilience

CWE · MITRE source

CWE-94Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · CVEs in our corpus: 6,897

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 4 mapping(s) from 2 framework(s): CAPEC 3 (partial) · CSF 2.0 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-34 Non-modifiable Executable Programs
  • SC-44 Detonation Chambers
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.1

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control Title Family Why it addresses this CWE
SC-34Non-modifiable Executable ProgramsSCMakes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
SC-44Detonation ChambersSCDynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
SI-10Information Input ValidationSIValidates inputs used in dynamic code generation to block injected directives.
SI-16Memory ProtectionSIDirectly prevents execution of attacker-supplied code written into data memory regions.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2019-7609 KEV 10.010.00.95342019-03-25
CVE-2021-22205 KEV 10.010.00.99732021-04-23
CVE-2022-22947 KEV 10.010.00.98252022-03-03
CVE-2022-24816 KEV 10.010.00.98522022-04-13
CVE-2023-41892 10.010.00.92552023-09-13
CVE-2023-46731 10.010.00.88532023-11-06
CVE-2024-21650 10.010.00.93482024-01-08
CVE-2024-25600 10.010.00.88232024-06-04
CVE-2025-32432 KEV 10.010.00.99842025-04-25
CVE-2025-47916 10.010.00.83732025-05-16
CVE-2025-5952810.010.00.91232025-09-22
CVE-2025-37164 KEV 10.010.00.90192025-12-16
CVE-2008-4250 KEV 9.99.80.98752008-10-23
CVE-2009-1151 KEV 9.99.80.95442009-03-26
CVE-2012-0391 KEV 9.99.80.75962012-01-08
CVE-2013-4810 KEV 9.99.80.79002013-09-16
CVE-2014-6287 KEV 9.99.80.99322014-10-07
CVE-2015-1635 KEV 9.99.81.00002015-04-14
CVE-2016-5734 9.99.80.81372016-07-03
CVE-2017-7494 KEV 9.99.80.99452017-05-30
CVE-2017-9841 KEV 9.99.81.00002017-06-27
CVE-2018-1207 9.99.80.90332018-03-23
CVE-2018-1270 9.99.80.77242018-04-06
CVE-2018-1273 KEV 9.99.80.95712018-04-11
CVE-2018-7602 KEV 9.99.80.99242018-07-19