CWE-94Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · CVEs in our corpus: 7,446

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Last updated: 16 October 2026 10:19 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-34 Non-modifiable Executable Programs
SC-44 Detonation Chambers
SI-10 Information Input Validation
SI-16 Memory Protection

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.3.1

NIST 800-53 r5 controls PROPOSED for this weakness (4)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SI-10`	Information Input Validation	SI	graded mostly Validates inputs used in dynamic code generation to block injected directives.
`SC-34`	Non-modifiable Executable Programs	SC	Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
`SC-44`	Detonation Chambers	SC	Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
`SI-16`	Memory Protection	SI	Directly prevents execution of attacker-supplied code written into data memory regions.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-7609` KEV	10.0	10.0	0.9534	2019-03-25
`CVE-2021-22205` KEV	10.0	10.0	0.9973	2021-04-23
`CVE-2022-22947` KEV	10.0	10.0	0.9825	2022-03-03
`CVE-2022-24816` KEV	10.0	10.0	0.9991	2022-04-13
`CVE-2023-41892`	10.0	10.0	0.9422	2023-09-13
`CVE-2023-46731`	10.0	10.0	0.8853	2023-11-06
`CVE-2024-21650`	10.0	10.0	0.9348	2024-01-08
`CVE-2024-25600`	10.0	10.0	0.8823	2024-06-04
`CVE-2025-32432` KEV	10.0	10.0	0.9979	2025-04-25
`CVE-2025-47916`	10.0	10.0	0.8419	2025-05-16
`CVE-2025-59528`	10.0	10.0	0.8622	2025-09-22
`CVE-2025-37164` KEV	10.0	10.0	0.9019	2025-12-16
`CVE-2008-4250` KEV	9.9	9.8	0.9875	2008-10-23
`CVE-2009-1151` KEV	9.9	9.8	0.9657	2009-03-26
`CVE-2012-0391` KEV	9.9	9.8	0.7560	2012-01-08
`CVE-2013-4810` KEV	9.9	9.8	0.7947	2013-09-16
`CVE-2014-6287` KEV	9.9	9.8	0.9932	2014-10-07
`CVE-2015-1635` KEV	9.9	9.8	1.0000	2015-04-14
`CVE-2016-5734`	9.9	9.8	0.8137	2016-07-03
`CVE-2017-7494` KEV	9.9	9.8	0.9945	2017-05-30
`CVE-2017-9841` KEV	9.9	9.8	1.0000	2017-06-27
`CVE-2018-1207`	9.9	9.8	0.9009	2018-03-23
`CVE-2018-1270`	9.9	9.8	0.7748	2018-04-06
`CVE-2018-1273` KEV	9.9	9.8	0.9696	2018-04-11
`CVE-2018-7602` KEV	9.9	9.8	0.9917	2018-07-19