Also known as: Reflection Injection
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Last updated
If the product uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.
68 recorded CVEs are caused by CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')). The highest-severity and most recent are shown first. 37 new CWE-470 CVEs have been recorded so far in 2026 (9 in 2025).
Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
IBM WebSphere eXtreme Scale's OQL is affected by remote code execution
Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
HTML Cache Poisoning through Unsafe Reflections
Unsafe Deserialization Vulnerability
Showing 12 of 68 recorded CWE-470 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-470 vulnerabilitiesWhat can happen when CWE-470 is exploited.
Execute Unauthorized Code or Commands, Alter Execution Logic
Affects: Integrity, Confidentiality, Availability, Other
The attacker might be able to execute code that is not directly accessible to the attacker. Alternately, the attacker could call unexpected code in the wrong place or the wrong time, possibly modifying critical system state.
DoS: Crash, Exit, or Restart, Other
Affects: Availability, Other
The attacker might be able to use reflection to call the wrong code, possibly with unexpected arguments that violate the API (CWE-227). This could cause the product to exit or hang.
Read Application Data
Affects: Confidentiality
By causing the wrong code to be invoked, the attacker might be able to trigger a runtime error that leaks sensitive information in the error message, such as CWE-536.
Typically introduced during these phases of the software lifecycle.
Languages
Practical mitigations for CWE-470, grouped by where in the lifecycle they apply.
Refactor your code to avoid using reflection.
Do not use user-controlled inputs to select and load classes or code.
Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Illustrative examples from MITRE showing how the weakness appears in code.
A common reason that programmers use the reflection API is to implement their own command dispatcher. The following example shows a command dispatcher that does not use reflection:
Safe example
String ctl = request.getParameter("ctl");Vulnerable example
String ctl = request.getParameter("ctl");Vulnerable example
String ctl = request.getParameter("ctl");Real CVEs that MITRE cites as examples of this weakness.
CAPEC attack patterns that exploit this weakness.
Common questions about CWE-470.
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Get alerted the moment a new CWE-470 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.