On this page
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Weakness Summary
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
- Canonical source: MITRE CWE-95 (opens in a new tab)
- Published Atomicorp CVE observations: 19
- Distinct affected products in those observations: 17
- Active Atomicorp rules associated with this weakness: 31
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2013-10070 | PHP-Charts v1.0 PHP Code Execution Vulnerability | PHP-Charts | Protected by Atomicorp rules | 340087 , 340128 , 380018 , 390801 , 393655 |
| CVE-2024-21650 | XWiki < 4.10.20 - Remote code execution | xwiki | Protected by Atomicorp rules | 340130 |
| CVE-2024-36401 | GeoServer Unauthenticated Remote Code Execution in Evaluating Property Name Expressions (CVE-2024-36401) | geoserver | Protected by Atomicorp rules | 340087 , 340095 , 344370 |
| CVE-2024-7954 | SPIP Unauthenticated RCE via porte_plume Plugin | SPIP | Protected by Atomicorp rules | 340023 , 340128 , 342259 , 344370 , 380018 , 390801 |
| CVE-2025-24893 | XWiki Platform - Remote Code Execution | xwiki | Protected by Atomicorp rules | 340023 , 347009 |
| CVE-2026-46562 | Yamcs: Remote Code Execution via Mission Database algorithm override | yamcs | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-47391 | PraisonAI's unauthenticated A2A official example can reach real LLM-driven eval() tool execution | PraisonAI | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-19626 | Tenable Security Center Report Charting RCE | security center | Protected by Atomicorp rules | 330791 , 340011 , 340128 , 340152 , 380018 , 390801 |
| CVE-2026-39932 | OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection | openemr | Protected by Atomicorp rules | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | Protected by Atomicorp rules | 340011 , 340087 , 340095 , 344363 , 346755 , 360152 , 390801 |
| CVE-2025-31114 | Fooocus webui vulnerable to Remote Code Execution | Fooocus | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61511 | vBulletin 6.x - Remote Code Execution | vBulletin | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 360151 , 393655 |
| CVE-2023-37462 | XWiki Platform - Remote Code Execution | xwiki | Detected by Atomicorp rules | 340130 |
| CVE-2025-66474 | XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection | xwiki-rendering | Protected by Atomicorp rules | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-55094 | Taskcluster: Unauthenticated remote code execution in web-server via GraphQL filter argument (sift $where) | taskcluster | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-40187 | Authenticated RCE via Malicious eTemplate Upload in EGroupware | egroupware | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-48868 | Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive | horilla | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-39423 | Stored XSS via Eval Injection in EchartsRander Component | maxkb | Protected by Atomicorp rules | 333140 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-101861 | Langflow Code Execution via eval() in Component Input Schema | langflow | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 330791 | Active | disruptive (deny) |
| 333140 | Active | disruptive (deny) |
| 340011 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340130 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 360151 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 380018 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims: