CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Last updated
Overview
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
Real-world CVEs
58 recorded CVEs are caused by CWE-913 (Improper Control of Dynamically-Managed Code Resources), including 1 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 16 new CWE-913 CVEs have been recorded so far in 2026 (15 in 2025).
- CVE-2025-68613CISA KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
Critical · CVSS 9.4 · EPSS 100th2025-12-19 - CVE-2026-47208
vm2: Sandbox Breakout Using Promise Species
Critical · CVSS 10.0 · EPSS 53th2026-06-12 - CVE-2026-47137
vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE
Critical · CVSS 10.0 · EPSS 31th2026-06-12 - CVE-2026-47131
vm2: Sandbox Escape
Critical · CVSS 10.0 · EPSS 47th2026-06-12 - CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
Critical · CVSS 10.0 · EPSS 98th2026-03-31 - CVE-2023-29199Critical · CVSS 10.0 · EPSS 89th2023-04-14
- CVE-2023-29017
vm2 Sandbox Escape vulnerability
Critical · CVSS 10.0 · EPSS 99th2023-04-06 - CVE-2022-36067Critical · CVSS 10.0 · EPSS 99th2022-09-06
- CVE-2025-46673Critical · CVSS 9.9 · EPSS 39th2025-04-27
- CVE-2023-37271
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape
Critical · CVSS 9.9 · EPSS 56th2023-07-11 - CVE-2026-47698
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
Critical · CVSS 9.8 · EPSS 44th2026-08-17 - CVE-2026-47210
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
Critical · CVSS 9.8 · EPSS 77th2026-06-12
Showing 12 of 58 recorded CWE-913 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-913 vulnerabilitiesCommon consequences
What can happen when CWE-913 is exploited.
Execute Unauthorized Code or Commands
Affects: Integrity
Varies by Context, Alter Execution Logic
Affects: Other, Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-913, grouped by where in the lifecycle they apply.
For any externally-influenced input, check the input against an allowlist of acceptable values.
Refactor the code so that it does not need to be dynamically managed.
How to detect it
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
This example attempts to write user messages to a message file and allow users to view them.
Vulnerable example
$MessageFile = "messages.out";Attack input
name=h4x0rAttack input
<?php system("/bin/ls -l");?>A common reason that programmers use the reflection API is to implement their own command dispatcher. The following example shows a command dispatcher that does not use reflection:
Safe example
String ctl = request.getParameter("ctl");Vulnerable example
String ctl = request.getParameter("ctl");Vulnerable example
String ctl = request.getParameter("ctl");Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2022-2054 — Python compiler uses eval() to execute malicious strings as Python code.
- CVE-2018-1000613 — Cryptography API uses unsafe reflection when deserializing a private key
- CVE-2015-8103 — Deserialization issue in commonly-used Java library allows remote execution.
- CVE-2006-7079 — Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
- CVE-2012-2055 — Source version control product allows modification of trusted key using mass assignment.
Frequently asked questions
Common questions about CWE-913.
- What is CWE-913?
- The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
- What CVEs are caused by CWE-913?
- 58 recorded CVEs are attributed to CWE-913, including CVE-2025-68613, CVE-2026-47208, CVE-2026-47137. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- How do you prevent CWE-913?
- For any externally-influenced input, check the input against an allowlist of acceptable values.
- How is CWE-913 detected?
- Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
- What are the consequences of CWE-913?
- Exploiting CWE-913 can lead to: Execute Unauthorized Code or Commands, Varies by Context, Alter Execution Logic.
- Is CWE-913 actively exploited?
- Yes. 1 CWE-913 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 58 recorded CVEs.
References
- MITRE CWE definition (CWE-913) (opens in a new tab)
- CWE-913 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-913
Get alerted the moment a new CWE-913 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.