Cyber Resilience

CWE · MITRE source

CWE-94Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · CVEs in our corpus: 6,549

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 16 mapping(s) from 5 framework(s): ATT&CK 10 (partial) · CAPEC 3 (partial) · OWASP-Web 1 (full) · ASVS 5.0 1 (mostly) · CSF 2.0 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

NIST 800-53 r5 controls that address this weakness (4)AI

Control Title Family Why it addresses this CWE
SC-34Non-modifiable Executable ProgramsSCMakes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
SC-44Detonation ChambersSCDynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
SI-10Information Input ValidationSIValidates inputs used in dynamic code generation to block injected directives.
SI-16Memory ProtectionSIDirectly prevents execution of attacker-supplied code written into data memory regions.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1059 Command and Scripting Interpreter←P →MT1059.001 PowerShell→MT1059.002 AppleScript←P →MT1059.003 Windows Command Shell→PT1059.004 Unix Shell←P →MT1059.005 Visual Basic←P →MT1059.006 Python←P →MT1059.007 JavaScript←P →MT1059.010 AutoHotKey & AutoIT→MT1059.011 Lua←P →MT1068 Exploitation for Privilege Escalation←P →PT1190 Exploit Public-Facing Application←P →MT1203 Exploitation for Client Execution←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2008-4250 KEV10.09.80.98752008-10-23
CVE-2009-0238 KEV10.08.80.43062009-02-25
CVE-2009-1151 KEV10.09.80.95442009-03-26
CVE-2009-0556 KEV10.08.80.67542009-04-03
CVE-2009-0557 KEV10.07.80.58552009-06-10
CVE-2012-0391 KEV10.09.80.75072012-01-08
CVE-2012-0158 KEV10.08.80.99972012-04-10
CVE-2012-1535 KEV10.07.80.70382012-08-15
CVE-2013-4810 KEV10.09.80.79002013-09-16
CVE-2013-3906 KEV10.07.80.84972013-11-06
CVE-2014-6287 KEV10.09.80.99322014-10-07
CVE-2014-4148 KEV10.08.80.50702014-10-15
CVE-2015-1635 KEV10.09.81.00002015-04-14
CVE-2017-7494 KEV10.09.80.99452017-05-30
CVE-2017-9841 KEV10.09.81.00002017-06-27
CVE-2017-9822 KEV10.08.80.94792017-07-20
CVE-2017-8759 KEV10.07.80.88702017-09-13
CVE-2018-1273 KEV UPD10.09.80.95652018-04-11
CVE-2018-7602 KEV10.09.80.99242018-07-19
CVE-2018-14667 KEV10.09.80.74172018-11-06
CVE-2019-9082 KEV10.08.80.97422019-02-24
CVE-2019-7609 KEV10.010.00.95342019-03-25
CVE-2019-0193 KEV10.07.20.83552019-08-01
CVE-2019-16759 KEV10.09.80.99732019-09-24
CVE-2019-4716 KEV10.09.80.86442019-12-18