Threadlinqs IntelligenceStart free

Weakness · BaseCWE-94

CWE-94: Improper Control of Generation of Code ('Code Injection')

Likelihood of exploit: MediumKEV-linkedBase

As of 2026-10-05, CWE-94 (Code Injection) underlies 88 CVEs tracked by Threadlinqs, 20 of them in the CISA Known Exploited Vulnerabilities catalog, and is cited by 222 tracked threats. MITRE rates its likelihood of exploit as Medium.

CVEs
88Mapped to CWE-94
CISA KEV
20Exploited in the wild
Critical
30CVSS v3 critical CVEs
Threats
222Tracked campaigns citing it
Likelihood
MediumMITRE likelihood of exploit

Last updated:

What is CWE-94?

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CWE-94 is a base-level weakness in MITRE’s Common Weakness Enumeration, with a MITRE likelihood of exploit of Medium. Applicable platforms: Language: Interpreted; Technology: AI/ML.

Source: MITRE CWE (CWE-94 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data.

Consequences

  • Access Control — Bypass Protection Mechanism. In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
  • Access Control — Gain Privileges or Assume Identity. Injected code can access resources that the attacker is directly prevented from accessing.
  • Integrity, Confidentiality, Availability — Execute Unauthorized Code or Commands. When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing.
  • Non-Repudiation — Hide Activities. Often the actions performed by injected control code are unlogged.

Source: MITRE CWE, common consequences.

How CWE-94 is exploited in the wild

Threadlinqs maps 88 CVEs to CWE-94, published between 2008-10-23 and 2026-09-29. 20 are listed in CISA’s Known Exploited Vulnerabilities catalog, the authoritative record of exploitation in the wild, and 4 are tied to ransomware campaigns. By CVSS v3 severity the set splits into 30 critical, 22 high, 13 medium, 13 low. The highest EPSS score in the set is 94.4% (CVE-2021-22205), the modelled probability of exploitation in the next 30 days. 222 tracked threats reference CWE-94 directly or through a CVE it covers; the most recent is “AI-accelerated intrusions: Microsoft 2026 Digital Defense Report on phishing, public-facing app exploitation, and AI-enabled attacker tooling (s1ngularity, PromptLock, JADEPUFFER/ENCFORGE)” (2026-10-03). Affected products concentrate in SourceCodester (6), Microsoft (5), IBM (4), among 59 vendors in total.

Vulnerabilities (CVEs)

Showing 40 of 88 CVEs mapped to CWE-94, CISA KEV first, then by CVSS score.

  • CVE-2021-22205 — CISA KEV · CVSS 10 critical · EPSS 94.4% · published 2021-04-23
  • CVE-2025-32432 — CISA KEV · CVSS 10 critical · EPSS 88.3% · published 2025-04-25
  • CVE-2023-3519 — CISA KEV · CVSS 9.8 critical · EPSS 93.8% · published 2023-07-19
  • CVE-2025-3248 — CISA KEV · CVSS 9.8 critical · EPSS 92.0% · published 2025-04-07
  • CVE-2008-4250 — CISA KEV · CVSS 9.8 critical · EPSS 92.0% · published 2008-10-23
  • CVE-2026-1281 — CISA KEV · CVSS 9.8 critical · EPSS 71.7% · published 2026-01-29
  • CVE-2026-1340 — CISA KEV · CVSS 9.8 critical · EPSS 67.8% · published 2026-01-29
  • CVE-2025-54068 — CISA KEV · CVSS 9.8 critical · EPSS 63.3% · published 2025-07-17
  • CVE-2026-60004 — CISA KEV · CVSS 9.8 critical · EPSS 23.9% · published 2026-08-26
  • CVE-2026-33017 — CISA KEV · CVSS 9.8 critical · EPSS 5.6% · published 2026-03-20
  • CVE-2026-34197 — CISA KEV · CVSS 8.8 high · EPSS 84.1% · published 2026-04-01
  • CVE-2025-49704 — CISA KEV · CVSS 8.8 high · EPSS 59.5% · published 2025-07-08
  • CVE-2021-22894 — CISA KEV · CVSS 8.8 high · EPSS 41.2% · published 2021-05-27
  • CVE-2026-65660 — CISA KEV · CVSS 8.8 high · EPSS 2.1% · published 2026-08-11
  • CVE-2025-62593 — CISA KEV · CVSS 8.8 high · EPSS 1.0% · published 2025-11-26
  • CVE-2026-3910 — CISA KEV · CVSS 8.8 high · EPSS 0.6% · published 2026-03-13
  • CVE-2020-8243 — CISA KEV · CVSS 7.2 high · EPSS 90.7% · published 2020-09-29
  • CVE-2026-15410 — CISA KEV · CVSS 7.2 high · EPSS 76.3% · published 2026-07-14
  • CVE-2025-4428 — CISA KEV · CVSS 7.2 high · EPSS 47.9% · published 2025-05-13
  • CVE-2021-22900 — CISA KEV · CVSS 7.2 high · EPSS 14.1% · published 2021-05-27
  • CVE-2026-61447 — CVSS 10 critical · EPSS 0.5% · published 2026-07-11
  • CVE-2026-26030 — CVSS 10 critical · EPSS 0.1% · published 2026-02-19
  • CVE-2026-21877 — CVSS 9.9 critical · EPSS 14.1% · published 2026-01-08
  • CVE-2026-21669 — CVSS 9.9 critical · EPSS 0.2% · published 2026-03-12
  • CVE-2026-42898 — CVSS 9.9 critical · EPSS 0.1% · published 2026-05-12
  • CVE-2026-5366 — CVSS 9.9 critical · published 2026-06-20
  • CVE-2026-77806 — CVSS 9.8 critical · EPSS 4.2% · published 2026-08-21
  • CVE-2026-73487 — CVSS 9.8 critical · EPSS 0.9% · published 2026-08-13
  • CVE-2026-77647 — CVSS 9.8 critical · EPSS 0.8% · published 2026-08-20
  • CVE-2025-11837 — CVSS 9.8 critical · EPSS 0.7% · published 2026-01-02
  • CVE-2026-18162 — CVSS 9.8 critical · EPSS 0.4% · published 2026-09-22
  • CVE-2026-67919 — CVSS 9.8 critical · EPSS 0.2% · published 2026-08-17
  • CVE-2026-38165 — CVSS 9.8 critical · EPSS 0.2% · published 2026-08-17
  • CVE-2026-67960 — CVSS 9.8 critical · EPSS 0.1% · published 2026-08-17
  • CVE-2026-18667 — CVSS 9.6 critical · EPSS 0.3% · published 2026-08-03
  • CVE-2026-71319 — CVSS 9.6 critical · EPSS 0.3% · published 2026-08-05
  • CVE-2026-19478 — CVSS 9.4 critical · published 2026-08-17
  • CVE-2026-36418 — CVSS 9.1 critical · EPSS 0.4% · published 2026-06-17
  • CVE-2026-21671 — CVSS 9.1 critical · EPSS 0.3% · published 2026-03-12
  • CVE-2026-2701 — CVSS 9.1 critical · EPSS 0.2% · published 2026-04-02

Affected vendors

Threat activity

222 tracked threats cite CWE-94; the 25 most recent are listed.

Mitigations

  • Architecture and Design: Refactor your program so that you do not have to dynamically generate code.
  • Architecture and Design: Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
  • Implementation / Input Validation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected…
  • Testing: Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible.
  • Testing: Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
  • Operation / Compilation or Build Hardening: Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
  • Operation / Environment Hardening: Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
  • Implementation: For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

Source: MITRE CWE, potential mitigations.

Detection methods (MITRE CWE)

  • Automated Static Analysis (effectiveness: High): Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher.