Expression Language injection
Summary: PortSwigger describes server-side code injection as arising when an application places user-controllable data into a string that a code interpreter evaluates dynamically, letting an attacker who supplies unvalidated input modify and inject arbitrary code the server then executes. The write-up rates these vulnerabilities High and states they usually lead to complete compromise of the application's data and functionality, and often of the hosting server, which may then serve as a platform for further attacks.
What's compelling: The source's own severity call is complete compromise of application data and functionality, often extending to the host server - so a single unvalidated input that reaches a dynamic evaluator can hand an attacker the machine your other controls assume is trusted.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026