CWE-627: Dynamic Variable Evaluation
Filter
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
What the weakness is: CWE-627 at MITRE. All weaknesses
Ask an AI about CWE-627
Show the prompt
Explain CWE-627: Dynamic Variable Evaluation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/627.html and https://cve.bz/cve/cwe/627?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2026-2452EPSS 0.3%
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a secu…
- 7.5CVE-2026-2451EPSS 0.3%
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a secu…
- 7.5CVE-2026-2415EPSS 0.3%
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two se…
- 9.8CVE-2024-8953EPSS 1.2%
In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.
- 5.5CVE-2023-31032EPSS 0.2%
NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.