Common Weakness Enumeration
CWE-627 Dynamic Variable Evaluation
Description
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-627 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-r8p8-qw9w-j9qv | CVE-2026-2415 | HIGH |
pretix unsafely evaluates variables in emails |
2026-03-13 | |
| GHSA-hmgh-466j-fx4c | CVE-2025-55346 | CRITICAL |
Flowise vulnerable to RCE via Dynamic function constructor injection |
2025-10-06 | |
| GHSA-5xg7-5662-8x7j | CVE-2024-8953 | HIGH |
Composio Eval Injection Vulnerability |
2025-03-22 | |
| GHSA-cq96-9974-v8hm | - | LOW |
Dynamic Variable Evaluation in qiskit-ibm-runtime |
2024-03-20 |