Weakness (CWE)
CWE-627: Dynamic Variable Evaluation
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
How to prevent it (3 mitigations)
-
Implementation
Refactor the code to avoid dynamic variable evaluation whenever possible.
-
Implementation
Use only allowlists of acceptable variable or function names.
-
Implementation
For function names, ensure that you are only calling functions that accept the proper number of arguments, to avoid unexpected null arguments.
Source: MITRE CWE-627
5 results · Clear filters · Feed
-
High 7.5
Unsafe variable evaluation in email templates
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It w…
-
High 7.5
Unsafe variable evaluation in email templates
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It w…
-
High 7.5
Unsafe variable evaluation in email templates
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs: *…
-
High 7.2
Unsafe eval usage in composiohq/composio
In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.
-
High 7.5
CVE
NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.