Skip to content
OpenAdvisories

Weakness (CWE)

CWE-96: Improper Neutralization of Directives in Statically Saved Code

Base Draft

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

How to prevent it (2 mitigations)

  1. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

  2. Implementation

    Perform proper output validation and escaping to neutralize all code syntax from data written to code files.

Source: MITRE CWE-96

All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.6
    CVE-2026-114125

    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…

    storybookjs storybook storybook @storybook/addon-vitest npm
  • High 7.2
    CVE-2026-85475

    Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

    A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOG…

    Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.7
  • High 8.7
    CVE-2026-68489

    Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenti…

    WebPros Plesk extension "Node.js Toolkit" Plesk extension "Ruby"
  • High 8.1
    GHSA-5c6j-r48x-rmvq

    Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

    ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output witho…

    serialize-javascript npm
  • High 7.2
    CVE-2025-36595

    Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically…

    Dell Unisphere for PowerMax vApp,
  • High 7.5
    CVE-2024-13267

    Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

    Drupal Opigno TinCan Question Type
  • High 7.5
    CVE-2024-13265

    Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

    Drupal Opigno Learning path drupal/opigno_learning_path Packagist
  • High 8.6
    CVE-2024-32487

    less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandl…

    less less Debian Ubuntu
  • High 8.8
    CVE-2022-43938 EPSS 26%

    Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. 

    Hitachi Vantara Pentaho Business Analytics Server
  • High 7.7
    CVE-2022-0895

    Static Code Injection in microweber/microweber

    Static Code Injection in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.2
    CVE-2021-39115 Public exploit

    Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Adminis…

    Atlassian Jira Service Desk Server Jira Service Desk Data Center Web / CMS