cwe-94-code-injection

To fix CWE-94 code injection vulnerabilities in Java, replace dynamic code execution like ScriptEngine.eval() with predefined, safe operations. This remediates the risk by ensuring user input never executes directly as code.

Code injection occurs when untrusted input is passed directly into ScriptEngine.eval(), allowing arbitrary code execution. This critical vulnerability can lead to full system compromise if user-controlled data is evaluated as executable script.

Secure dynamic script execution by replacing eval calls with deterministic, safe operations mapping to a predefined set. If dynamic scripting is strictly unavoidable, execute the scripts strictly within heavily sandboxed environments to limit access.

You need a sandboxed environment to run dynamic Java scripts safely only when dynamic scripting is absolutely unavoidable. The primary remediation strategy is to entirely replace ScriptEngine.eval() with predefined, safe operations.

Passing user input directly to ScriptEngine.eval() remains insecure even with validation. You must refactor the application to avoid executing user-provided scripts directly, replacing the dynamic evaluation with predefined, safe operations.

SAST flags ScriptEngine.eval() as a code injection risk because the method executes dynamically generated code. If untrusted or user-controlled input reaches this evaluator, it creates a CWE-94 vulnerability allowing potential system compromise.