CWE-95 动态执行代码中指令转义处理不恰当(Eval注入) 类弱点 126 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-95 属于代码注入类漏洞，指程序在接收上游输入后，未正确净化代码语法便直接用于动态执行调用（如 eval）。攻击者通常通过构造恶意输入，诱导程序执行任意代码，从而获取系统控制权或窃取数据。开发者应避免使用动态执行函数，若必须使用，需严格对输入进行白名单校验或转义特殊字符，确保仅允许预期的安全代码片段被执行，从而从根源上阻断注入风险。
use CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnamadd_key(",","); system("/bin/ls");def main(): sum = 0 try: numbers = eval(input("Enter a comma-separated list of numbers: ")) except SyntaxError: print("Error: invalid input") return for num in numbers: sum = sum + num print(f"Sum of {numbers} = {sum}") main()__import__('subprocess').getoutput('rm -r *')CWE-95（动态执行代码中指令转义处理不恰当(Eval注入)） 是常见的弱点类别，本平台收录该类弱点关联的 126 条 CVE 漏洞。