Semgrep
semgrep.dev › secure coding › python › prevent code injection for python
Prevent Code Injection for Python - Semgrep
1 week ago - # Value supplied by user user_input = "__import__('code').InteractiveInterpreter().runsource('import requests;requests.get(\'localhost:3000\')')" # Vulnerable eval(user_input) ... Do not use eval(). Alternatively: If you need to use eval() with non-literal values, ensure that executed content is not controllable by external sources. If it’s not possible, strip everything except alphanumeric characters from the input. Don’t try to make eval safe with tricks such as {'__builtins__':{}}. python.lang.security.audit.eval-detected.eval-detected
Wisc
research.cs.wisc.edu › mist › SoftwareSecurityCourse › Chapters › 3_8_3-Code-Injections.pdf pdf
Introduction to Software Security Chapter 3.8.3: Code Injections
Code injection is a risk with languages that execute or interpret script because of the ease of running a · string as an executable statement or statements at runtime (commonly called “eval”). For example, popular languages that have this ability include: JavaScript, Perl, Python, and Ruby.
Code Injection Vulnerability Caused by eval() in function_message Function
This code is vulnerable to CWE - 94: Code Injection due to the use of the eval() function. The function_message function processes a string msg. When msg starts with "Running " and matches a specific regular expression, the function extracts the function_name and function_args. For certain function_name values, it uses eval() to execute the function_args string as a Python ... More on github.com
5
May 8, 2025python - I need to inject the code with eval() function to complete my task, do i need to changes in eval() funcction? - Stack Overflow
I need to complete this task, please see the below comments, You are calling the hack() function in your text files which is a good start. The goal of the task inject the hack() function into the P... More on stackoverflow.com
Python Injection - is there such a thing? - Stack Overflow
Would it be possible that if that ... python code could be injected and executed in the app? Is there a way to easily and harmlessly test for this vulnerability - if it is indeed a potential vulnerability? I can't seem to find many web resources on this topic. ... Python injection? Sure, if you have eval() in your ... More on stackoverflow.com
Why is exec() and eval() not considered good practice?
exec and eval basically execute the code AS IF you wrote it. Maybe if you're the one using it would be OK, but on public facing applications then you have the risk of code injection. Someone crafting a string that will do something completely different. It is bad practice just for that, and you can make it work with other approaches. On your case, there are easier ways of finding something by its "name". You can set up a dict of objects (IE AllItems). Whose key is your "nameOfWeapon" identifier. And do AllItems[nameOfWeapon] to get it. And after getting it you can call the method you have on it. More on reddit.com
27
50
July 27, 2024PortSwigger
portswigger.net › kb › issues › 00100f10_python-code-injection
Python code injection - PortSwigger
Server-side code injection vulnerabilities arise when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter. If the user data is not strictly validated, an attacker can use crafted input to modify the code to be executed, and inject arbitrary code that will be executed by the server.
JFrog
jfrog.com › blog home › 23andme’s yamale python code injection, and properly sanitizing eval()
23andMe's Yamale Python code injection, and properly sanitizing eval()
September 1, 2022 - [x for x in (1).__class__.__base__.__subclasses__() if x.__name__ == 'catch_warnings'][0]()._module.__builtins__['print']([x for x in (1).__class__.__base__.__subclasses__() if x.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').system('cd /; python3 -m http.server')) There have been many writeups regarding this subject, but the short answer is – if you are passing completely unsanitized input to eval (regardless of builtins) then you are susceptible to arbitrary code injection.
Acunetix
acunetix.com › vulnerabilities › web › code-evaluation-python
Code Evaluation (Python) - Vulnerabilities - Acunetix
This script is vulnerable to Python code injection. The user input appears to be placed into a dynamically evaluated Python code statement, allowing an attacker to execute arbitrary Python code.
GitHub
github.com › letta-ai › letta › issues › 2613
Code Injection Vulnerability Caused by eval() in function_message Function · Issue #2613 · letta-ai/letta
May 8, 2025 - This code is vulnerable to CWE - 94: Code Injection due to the use of the eval() function. The function_message function processes a string msg. When msg starts with "Running " and matches a specific regular expression, the function extracts the function_name and function_args. For certain function_name values, it uses eval() to execute the function_args string as a Python expression.
Author letta-ai
Greg Scharf
blog.gregscharf.com › 2023 › 04 › 11 › code-injections
Code Injections :: Greg Scharf — Development & Security
April 11, 2023 - What you’re essentially doing is constructing a miniature Python application made up of a single string, which is necessary because the eval() method only takes one argument. The difference between code injection and command injection can sometimes be confusing, since in the following example we are injecting code that will ultimately execute commands on the system.
VK9 Security
vk9-sec.com › exploiting-python-eval-code-injection
Exploiting Python EVAL() Code Injection | VK9 Security
The eval() function in Python evaluates a string as a Python expression and returns the result. It allows developers to dynamically execute code during runtime, providing great flexibility. However, if user-supplied input is directly passed into eval(), it can lead to code injection vulnerabilities.
Medium
medium.com › swlh › hacking-python-applications-5d4cd541b3f1
Hacking Python Applications. And how attackers exploit common… | by Vickie Li | The Startup | Medium
November 15, 2019 - Dangerous functions in Python like eval(), exec() and input() can be used to achieve authentication bypass and even code injection.
Floyd
floyd.ch
Exploiting Python’s Eval | floyd's
Pingback: Exploiting Python Code Injection in Web Applications – My Blog · python module evalidate (pip3 install evalidate) solves this problem. It parses untrusted user code into Abstract Syntax Tree (AST) and checks each node. Code is evaluated then only if it consist only of safe nodes.
Stack Overflow
stackoverflow.com › questions › 76539692 › i-need-to-inject-the-code-with-eval-function-to-complete-my-task-do-i-need-to
python - I need to inject the code with eval() function to complete my task, do i need to changes in eval() funcction? - Stack Overflow
June 23, 2023 - import os from vulnerability import hack def login(username): users = ['Nkoli', 'Hyperion', 'Ori', 'Tony'] if username in users: return f"Welcome, {username}." else: return "" print("This code will log a username in") if os.path.exists("hack3.txt"): with open("hack3.txt", 'r') as in_file: user_input = in_file.read() else: user_input = input("Enter your username\n: ") // Then, we run the code print(eval(f"login('{user_input}')")) # hack1.txt hack() ... Do not use eval() for this. It's evil ... I believe this is an exercise from a cybersecurity MOOC, so I guess they're using this to demonstrate just how eval() introduces injection vulnerabilities.
Blogger
sethsec.blogspot.com › 2016 › 11 › exploiting-python-code-injection-in-web.html
Exploiting Python Code Injection in Web Applications
November 20, 2016 - Python code injection is a subset of server-side code injection, as this vulnerability can occur in many other languages (e.g., Perl and Ruby). In fact, for those of you who are CWE fans like I am, these two CWEs are right on point: CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Snyk
snyk.io › blog › code-injection-python-prevention-examples
Code injection in Python: examples and prevention | Snyk
December 6, 2023 - For example, with literal_eval(), the input 2 + 3 would be evaluated as the numeric value 5, while an input like __import__('os').system('rm -rf /') would raise a ValueError instead of executing the command. This effectively mitigates the security concerns associated with using eval() and provides a safer way to evaluate expressions that involve literals. Use parameterized queries or prepared statements to prevent SQL injection:
Medium
medium.com › @maikelmardjan › python-injection-attacks-1e9039222040
Python Injection Attacks. Finding eval(), exec(), and Insecure… | by Maikel Mardjan | Medium
March 2, 2026 - Injection occurs when untrusted input is treated as code or as part of a command. In Python, this most often manifests in three ways: ... Both eval() and exec() execute strings as Python code.
Orbisappsec
orbisappsec.com › home › blog › code injection via eval(): how a critical python flaw was fixed
Code Injection via eval(): How a Critical Python Flaw Was Fixed
June 3, 2026 - This is a CWE-95 code injection vulnerability in Brownie's Python CLI where `eval()` was used to parse network configuration input without proper sanitization. An attacker could inject malicious Python expressions that would execute with the ...
Invicti
invicti.com › web-application-vulnerabilities › code-evaluation-python
Code Evaluation (Python) - Web Application Vulnerabilities | Invicti
This application is vulnerable to Python code injection, a critical security flaw that occurs when user-supplied input is passed directly into Python's dynamic code evaluation functions (such as eval(), exec(), or compile()) without proper validation or sanitization.
Sourcery
sourcery.ai › vulnerabilities › python-django-security-injection-code-user-eval-format-string
Django Code Injection via eval() with Format Strings | Security Vulnerability Database | Sourcery
Data transformation pipelines: transform_code = transformation_template.format(**record); eval(transform_code) executes code from database records if attackers control record fields. Macro expansion systems: macro_result = expand_macros(user_input); eval(macro_result) enables injection when macro expansion includes user data without escaping. Django applications generate Python code dynamically using format strings to construct function definitions, class declarations, or executable statements, then execute generated code with eval() or exec(), allowing attackers to inject malicious code through format parameters.
Johal AI Hub
johal.in › detecting-and-preventing-code-injection-in-python-eval-and-exec-functions-7
Detecting and Preventing Code Injection in Python Eval and Exec Functions
March 22, 2026 - Unlike compiled languages where code execution paths are determined at compile time, Python's eval() and exec() functions evaluate and execute code at runtime. This flexibility enables powerful metaprogramming capabilities but also creates an ...
Pyre-check
pyre-check.org › 5001 - code injection
5001 - Code Injection | Pyre
Generally, we recommend not making calls to these functions with user input. If you only need to eval python datatypes you can use ast.literal_eval. Using it on arbitrary user input can still lead to DOS attack but can't be exploited for code execution (details).