Code injection is a vulnerability that occurs when an application passes untrusted input directly into a code interpreter, such as a shell, database, or programming language runtime. This allows attackers to execute arbitrary commands or scripts, potentially leading to data breaches, system compromise, or unauthorised access.

Remediation

To remediate, always validate and sanitise user input, avoid dynamic code execution with user-controlled data, and use safe APIs or libraries that separate code from data. Employing least privilege principles and input encoding can further reduce risk.

Metadata

• Severity: high
• Slug: code-injection

CWEs

• 94: Improper Control of Generation of Code ('Code Injection')

OWASP

• A03:2021: Injection