CAPEC-175
Code Inclusion
An adversary exploits a weakness on the target to force arbitrary code to be retrieved locally or from a remote location and executed. This differs from code injection in that code injection involves the direct inclusion of code while code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-175: Code Inclusion: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/175.html and https://cve.bz/cve/capec/175?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The target application must include external code/libraries that are executed when the application runs and the adversary must be able to influence the specific files that get included.
The victim must run the targeted application, possibly using the crafted parameters that the adversary uses to identify the code to include.
Resources required
The adversary may need the capability to host code modules if they wish their own code files to be included.
Weaknesses it exploits
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Recent CVEs with these weaknesses
- 4.4CVE-2026-123858
In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects
- 5.5CVE-2026-123854
In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module
- 7.8CVE-2026-123853
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process
- 7.0CVE-2026-123849
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
- 3.3CVE-2026-123843
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
- 7.8CVE-2026-123838
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
- 3.6CVE-2026-123833
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
- 9.6CVE-2026-123832
In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
One example of this type of attack pattern is PHP file include attacks where the parameter of an include() fu…
One example of this type of attack pattern is PHP file include attacks where the parameter of an include() function is set by a variable that an attacker is able to control. The result is that arbitrary code could be loaded into the PHP application and executed.
MITRE's words, unchanged: CAPEC-175 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.