CWE-627 (动态变量执行) — Vulnerability Class 5

CWE-627 represents a critical input validation weakness occurring in dynamic programming environments where user-supplied data directly influences variable names at runtime. This flaw allows attackers to manipulate the execution context by injecting malicious strings that resolve to arbitrary variables or functions, bypassing intended security controls. Exploitation typically involves crafting specific payloads that trick the interpreter into accessing sensitive memory locations or executing unintended code paths, potentially leading to data exfiltration or remote code execution. To mitigate this risk, developers must rigorously sanitize all user inputs before they are used in dynamic evaluation contexts. Implementing strict allowlists for permitted variable names, avoiding direct concatenation of user data into variable references, and utilizing static analysis tools to detect unsafe dynamic evaluations are essential practices for preventing this vulnerability and ensuring application integrity.