Dynamic code execution (ARCH2131)

Key python.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95

eval and exec run a string as Python code at runtime. When the input is untrusted, this is the broadest remote-code-execution primitive available.

Incorrect

def compute(request):
    expr = request.GET["expr"]
    return eval(expr)

Correct

import ast

def compute(request):
    expr = request.GET["expr"]
    return ast.literal_eval(expr)

Fix

Replace eval/exec with safe parsers (ast.literal_eval) or an explicit, bounded command map.