Skip to main content
User-controlled input is dynamically executed as code.

​
How to resolve

Eliminate dynamic code execution: Replace eval(), exec(), and similar functions with predefined logic using conditional statements, lookup tables, or function dictionaries. Use safe alternatives: If dynamic behavior is required, use sandboxed interpreters or domain-specific languages with restricted capabilities. Validate input strictly: If dynamic evaluation cannot be avoided, implement strict input validation using allowlists and reject any input containing code-like syntax. Apply code review: Audit all MCP tool implementations for dynamic code execution patterns and refactor to use static dispatch mechanisms.

​
Risk

Governance/Compliance Code injection vulnerabilities violate multiple security standards:
  • OWASP Top 10 (A03:2021 - Injection): Allows execution of unintended code through dynamic evaluation of untrusted input.
  • CWE-94 (Code Injection): Improper control of generation of code enables attackers to inject and execute arbitrary code.
  • NIST SP 800-53 (SI-10): Fails to validate information inputs, allowing malicious code to bypass security controls.
  • ISO 27001 (A.14.2.5): Does not follow secure system engineering principles that prevent code injection vulnerabilities.
  • OWASP MCP Top 10 (MCP05:2025 - Command Injection & Execution): Dynamic code evaluation with unsanitized input enables arbitrary code execution in MCP server environments.
Security An attacker can execute arbitrary code within the application’s runtime environment, potentially gaining complete control over the MCP server process. This enables data theft, privilege escalation, system reconfiguration, or deployment of backdoors. The impact is particularly severe in MCP servers that handle sensitive data or have access to critical infrastructure.

​
Explanation

Code injection occurs when user-controlled input from MCP tool parameters is dynamically executed as code, allowing attackers to run arbitrary code in the application context. The scanner identifies dangerous functions like eval(), exec(), and similar dynamic code execution patterns. This vulnerability can be prevented by using predefined logic and data structures instead of dynamic code evaluation.

​
Specifications

Trigger
  • MCP server scan detects dynamic code execution functions (eval, exec, compile, etc.) that process user-controlled tool parameters
Severity
  • CRITICAL
Applies to: MCP Server