Code Injection via eval/exec

Description

Detects untrusted user input flowing into code evaluation functions (eval, exec, compile).

How to fix

Use ast.literal_eval() for safe evaluation of literals.

```python
import ast
parsed = ast.literal_eval(user_input)
```

Learn more: https://shoulder.dev/learn/python/cwe-94/code-injection

Applies to

References

Scan for this issue

Real-world examples

Known CVEs in the Code Injection vulnerability class that this rule helps detect.

Related rules