Zennoxa Shield
Rules / Python
SHIELD-PY-008

Insecure use of eval()

criticalPythonCWE-95CVSS 9.8

What it detects

eval() with user input allows arbitrary Python code execution.

How to fix

Remove eval(). Use ast.literal_eval() for safe expression parsing of known data structures.

Vulnerable — Shield flags thisapp.py
from flask import Flask, request

app = Flask(__name__)

@app.route("/calc")
def calc():
    expression = request.args.get("expr", "")
    result = eval(expression)
    return {"result": result}
Fixed — scans cleanapp.py
import ast
from flask import Flask, request

app = Flask(__name__)

@app.route("/calc")
def calc():
    expression = request.args.get("expr", "")
    result = ast.literal_eval(expression)
    return {"result": result}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-008: Insecure use of eval() — Zennoxa Shield