Dynamic Code Execution (ARCH8131)

Key kotlin.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95

Flags ScriptEngine.eval / Groovy shell evaluate with a script built from request data.

Incorrect

engine.eval(req.getParameter("expr"))

Correct

val allowed = mapOf("sum" to ::sum)
allowed[req.getParameter("op")]?.invoke(args)

Fix

Never evaluate user input as code; map requests onto a fixed set of operations.