Cyber Resilience

CWE · MITRE source

CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Abstraction: Variant · CVEs in our corpus: 162

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Last updated: 11 August 2026 23:24 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SA-11 Developer Testing and Evaluation
  • SI-10 Information Input Validation
  • SA-15 Development Process, Standards, and Tools
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.2

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-46731 10.010.00.88532023-11-06
CVE-2024-21650 10.010.00.93482024-01-08
CVE-2023-26477 9.910.00.74762023-03-02
CVE-2024-36401 KEV 9.99.80.99792024-07-01
CVE-2024-36404 9.99.80.74912024-07-02
CVE-2024-7954 9.99.80.90052024-08-23
CVE-2025-24893 KEV 9.99.80.99862025-02-20
CVE-2026-33017 KEV 9.99.80.99842026-03-20
CVE-2023-37462 9.69.90.91492023-07-14
CVE-2022-36099 9.59.90.75892022-09-08
CVE-2022-36100 9.59.90.73612022-09-08
CVE-2023-29509 9.59.90.75692023-04-16
CVE-2023-35150 9.59.90.77652023-06-23
CVE-2023-50721 9.59.90.78812023-12-15
CVE-2024-31465 9.59.90.75582024-04-10
CVE-2024-31984 9.59.90.83002024-04-10
CVE-2024-31982 9.010.00.34282024-04-10
CVE-2026-0769 8.99.80.33832026-01-23
CVE-2023-7101 KEV 8.57.80.16832023-12-24
CVE-2025-54322 8.410.00.14232025-12-27
CVE-2026-1470 8.29.90.18722026-01-27
CVE-2024-31996 7.810.00.02102024-04-10
CVE-2013-10051 7.79.80.01982025-08-01
CVE-2022-36010 7.610.00.01232022-08-15
CVE-2025-55727 7.610.00.01052025-09-09