Cyber Posture

CWE · MITRE source

CWE-94Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · CVEs in our corpus: 6,217

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (4)AI

Control Title Family Why it addresses this CWE
SC-34Non-modifiable Executable ProgramsSCMakes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
SC-44Detonation ChambersSCDynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
SI-10Information Input ValidationSIValidates inputs used in dynamic code generation to block injected directives.
SI-16Memory ProtectionSIDirectly prevents execution of attacker-supplied code written into data memory regions.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2019-7609 KEV9.710.00.94432019-03-25
CVE-2021-22205 KEV9.710.00.94472021-04-23
CVE-2022-22947 KEV9.710.00.94462022-03-03
CVE-2014-6287 KEV9.69.80.94362014-10-07
CVE-2015-1635 KEV9.69.80.94312015-04-14
CVE-2017-7494 KEV9.69.80.94182017-05-30
CVE-2017-9841 KEV9.69.80.94212017-06-27
CVE-2018-1273 KEV9.69.80.94292018-04-11
CVE-2018-7602 KEV9.69.80.94382018-07-19
CVE-2019-16759 KEV9.69.80.94432019-09-24
CVE-2019-4716 KEV9.69.80.93372019-12-18
CVE-2019-10758 KEV9.69.90.94352019-12-24
CVE-2020-8644 KEV9.69.80.94062020-02-05
CVE-2021-44529 KEV9.69.80.94462021-12-08
CVE-2022-22963 KEV9.69.80.94462022-04-01
CVE-2022-22965 KEV9.69.80.94432022-04-01
CVE-2022-22954 KEV9.69.80.94442022-04-11
CVE-2022-24816 KEV9.610.00.93712022-04-13
CVE-2023-25717 KEV9.69.80.94242023-02-13
CVE-2023-33246 KEV9.69.80.94392023-05-24
CVE-2023-3519 KEV9.69.80.93842023-07-19
CVE-2024-4040 KEV9.69.80.94432024-04-22
CVE-2024-23692 KEV9.69.80.94302024-05-31
CVE-2024-36401 KEV9.69.80.94432024-07-01
CVE-2024-56145 KEV9.69.80.94152024-12-18