Injection
Untrusted input interpreted as code or commands by a downstream interpreter.
What it is
Injection drops from A03:2021 to A05:2025 but remains a critical category. It covers any vulnerability in which an attacker supplies data that the application then passes to an interpreter (SQL, shell, OS, expression engine, template, LDAP, XPath) without proper validation or parameterization. The interpreter executes the injected content, often granting the attacker the privileges of the application's identity in that subsystem. SQL injection in particular has appeared in every published OWASP Top 10 since the document's inception.
Common patterns
- •SQL queries built by string concatenation or template-string interpolation of user input.
- •Shell commands constructed from request parameters (filename, URL, hostname).
- •eval, new Function, or exec called with user-controlled strings.
- •NoSQL injection through MongoDB query operators accepted from request bodies ($where, $regex).
- •LDAP injection in directory queries built from user input.
- •XSS: HTML or JavaScript injected into pages via unsanitized output.
- •ORM injection: parameterized libraries used incorrectly, or raw queries bypassing the ORM's safety layer.
What Deva detects
Deva tracks data flow from request inputs through query builders, shell invocations, dynamic code paths, and template engines to identify cases where untrusted data reaches a sensitive sink without parameterization or sanitization. The rule pack covers language-specific patterns for Sequelize, Knex, Prisma raw, sqlx, pg, mysql2, psycopg2, SQLAlchemy text(), Django raw(), Active Record connection.execute(), JDBC PreparedStatement misuse, child_process variants in Node, subprocess in Python, Runtime.exec in Java, and JavaScript and Python eval surfaces.
CWE detection guides
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2008 | Heartland Payment Systems (130M records) | SQL injection in a public-facing web form gave attackers a foothold that they expanded into the payment processing network. At the time it was the largest disclosed payment-card breach in US history. |
| 2017 | Apache Struts CVE-2017-5638 (multiple victims) | An expression-language injection vulnerability in Apache Struts allowed remote code execution. Equifax, Canadian government agencies, and others were compromised through the same flaw before patches were applied. |
Compliance framework impact
- •NIST 800-53 SI-10 Information Input Validation
- •PCI-DSS v4.0 Req 6.2.4 Software engineering techniques
- •HIPAA 164.312(c)(1) Integrity controls
- •CMMC 2.0 SI.L2-3.14.1 Flaw remediation
Deva detects the injection patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.