CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Abstraction: Base · CVEs in our corpus: 23

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 1 framework(s): CAPEC 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-34 Non-modifiable Executable Programs
PR.PS-06
SA-11 Developer Testing and Evaluation
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.3.2

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SC-34`	Non-modifiable Executable Programs	SC	Eliminates the possibility of static code injection into saved executables by making the storage non-modifiable.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1027.009 Embedded Payloads→P

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-6143`	8.0	9.8	0.0617	2020-09-01
`CVE-2020-6144`	8.0	9.8	0.0617	2020-09-01
`CVE-2022-43938`	8.0	8.8	0.2644	2023-04-03
`CVE-2022-0895`	7.6	9.8	0.0175	2022-03-10
`CVE-2023-39726`	7.5	9.8	0.0103	2023-10-26
`CVE-2024-55877`	7.3	9.9	0.0156	2024-12-12
`CVE-2024-13264`	7.3	9.8	0.0046	2025-01-09
`CVE-2015-2079`	7.2	9.9	0.0146	2025-04-28
`CVE-2024-55662`	7.1	9.9	0.0076	2024-12-12
`CVE-2025-57707`	6.6	8.8	0.0066	2026-02-11
`CVE-2024-43400`	6.4	9.0	0.0049	2024-08-19
`CVE-2024-32487`	6.1	8.6	0.0063	2024-04-13
`CVE-2024-37900`	6.1	6.4	0.1580	2024-07-31
`CVE-2021-39115`	6.0	7.2	0.0448	2021-09-01
`CVE-2024-13265`	5.8	7.5	0.0056	2025-01-09
`CVE-2024-13267`	5.8	7.5	0.0056	2025-01-09
`CVE-2025-36595`	5.5	7.2	0.0055	2025-06-27
`CVE-2024-13268`	5.3	6.8	0.0047	2025-01-09
`CVE-2022-3960`	5.0	6.3	0.0045	2023-04-03
`CVE-2024-0788`	5.0	6.6	0.0024	2024-01-29
`CVE-2025-7825`	4.8	6.3	0.0025	2025-10-03
`CVE-2024-13263`	4.3	5.5	0.0026	2025-01-09