Code Injection.

A class of vulnerabilities where attacker-supplied data is interpreted and executed as code by an application, leading to arbitrary execution in its context. It belongs to the Attacks & Threats category of cybersecurity.

A class of vulnerabilities where attacker-supplied data is interpreted and executed as code by an application, leading to arbitrary execution in its context.

Code injection is the broad family of flaws in which untrusted input is incorporated into something the application later treats as program code, configuration, or markup, causing the runtime to execute it. Concrete instances include eval-based injection in JavaScript and Python, server-side template injection, expression-language injection (OGNL, SpEL), insecure deserialization that triggers gadget chains, and dynamic class loading from user data. Successful exploitation typically yields remote code execution under the application's identity, which is often a stepping stone to full host or cluster compromise. Defenses include never building code from input, using parameterized APIs, locking down dynamic features, and applying least-privilege runtime and sandboxing.

Defences for Code Injection typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Remote code execution, Arbitrary code execution.