Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) |
| OWASP | A03:2021 - Injection |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | Medium |
Description#
Your code uses ’eval’ or ’exec’ to execute code that comes from external input, such as function arguments or event data. This practice is risky because it allows untrusted data to control code execution.
Impact#
If exploited, an attacker could run arbitrary Python code on your server, leading to data theft, service disruption, or a complete system compromise. This could expose sensitive information and undermine the security of your entire application.