Code Injection.

Code injection (CWE-94) is the broad family of flaws in which untrusted input is incorporated into something the application later treats as program code, causing the runtime to execute it. Unlike command injection (which reaches the OS shell), code injection runs inside the application's own interpreter. Concrete instances include eval-based injection in JavaScript and Python, server-side template injection, expression-language injection (OGNL, SpEL), insecure deserialization that triggers gadget chains, and dynamic class loading from user data. Successful exploitation typically yields remote code execution under the application's identity — often a stepping stone to full host or cluster compromise.

Three landmark cases show the impact. Apache Struts CVE-2017-5638 allowed OGNL expressions in a malformed Content-Type header to execute; an unpatched instance caused the 2017 Equifax breach exposing ~147 million records. Log4Shell (CVE-2021-44228), CVSS 10.0, turned any logged string containing a JNDI lookup into a remote Java class load. Spring4Shell (CVE-2022-22965) abused Spring's data-binding to manipulate the ClassLoader and drop a web shell.

flowchart TD
  A[Untrusted input] --> B{Reaches a code-evaluating sink?}
  B -->|eval / template / OGNL / deserialize| C[Interpreter executes attacker code]
  B -->|Validated / parameterized| D[Treated as inert data]
  C --> E[RCE as app identity]
  E --> F[Host / cluster compromise]
  D --> G[Safe]

Defences: never build code, templates, or expressions from input; use parameterized and allow-listed APIs; disable or sandbox dynamic evaluation and deserialization; patch frameworks promptly; and run with least privilege so RCE yields the smallest possible blast radius.