CWE-94: Improper Control of Generation of Code
Sources read 2026-10-29. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
MITRE classes it as a base-level weakness and rates the likelihood of exploit as medium.
What it lets an attacker do
From MITRE's CWE catalogue
- Bypass Protection Mechanism (affects: access control)
- Gain Privileges or Assume Identity (affects: access control)
- Execute Unauthorized Code or Commands (affects: integrity, confidentiality, availability)
- Hide Activities (affects: non-repudiation)
On CISA's exploited list
From CISA's exploited list
6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-94, against 3 of 69 in the 90 days before. Over the whole catalogue 72 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-0322, Palo Alto Networks PAN-OS, added 2026-10-14
- CVE-2026-65660, Microsoft SharePoint, added 2026-09-25
- CVE-2026-60004, Gitea Gitea, added 2026-08-25
- CVE-2026-72530, TrueConf Server, added 2026-08-20
- CVE-2025-62593, Ray-Project Ray, added 2026-08-17
How MITRE says to find it
From MITRE's CWE catalogue
- Automated Static Analysis
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Architecture and Design: Refactor your program so that you do not have to dynamically generate code.
- Architecture and Design: Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- Testing: Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Attack patterns MITRE links to it
From MITRE's CWE catalogue
Our notes that name it
From our own notes
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us