# Eval sink code injection

Attacker-influenced strings reaching eval, new Function, const_get, require, autoload, or script engines as code

_Area: Web injection and code execution. Seen in 8 disclosed reports; 6 confirmed bounties, median $10,000, range $3,000-$50,000; latest 2026-10-08. Updated 2026-10-23._

## How it works
A value the attacker controls reaches an interpreter as code rather than as data. Two shapes: string-eval sinks (eval, new Function, a parser's JS/Lua engine, a backend script engine) execute the string directly [E2](https://bugbountylibrary.com/r/h1%3A3782701.md)[E4](https://bugbountylibrary.com/r/h1%3A3694007.md)[E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review.md)[E8](https://bugbountylibrary.com/r/h1%3A1401444.md); name-resolution sinks (const_get, require, PHP autoload via property_exists) treat the string as a name that resolves to executable code [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-20-github-pages-multiple-rces-via-kramdown-config-html.md)[E3](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md). The broken assumption is that the sink only ever receives trusted, structured data. Any path from request to sink becomes code execution.

## Where it shows up
- Free-form GraphQL `JSON`/`String` scalars forwarded into a query/filter/sort library [E2](https://bugbountylibrary.com/r/h1%3A3782701.md)[E4](https://bugbountylibrary.com/r/h1%3A3694007.md)
- Dependencies compiling strings with `new Function`/`eval` (sift `$where`, gray-matter JS engine) [E2](https://bugbountylibrary.com/r/h1%3A3782701.md)[E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review.md)
- Class-name options regex-validated then resolved via `const_get`; `:input` passed to `require` after snake_case strips non-alpha chars, allowing traversal [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-20-github-pages-multiple-rces-via-kramdown-config-html.md)
- Type-confused object params reaching `property_exists`/`class_exists`, triggering autoload `include()` [E3](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md)
- Backend DSL scripting constructs (`_script`, `script_fields`) reachable through a raw sort/query string [E4](https://bugbountylibrary.com/r/h1%3A3694007.md)
- Renderer extensions auto-enabled by gem availability, with unsafe sandbox wrappers (`loadstring`/`setfenv`) [E8](https://bugbountylibrary.com/r/h1%3A1401444.md)
- Native code concatenating attacker strings into JS executed in a page context [E5](https://bugbountylibrary.com/r/h1%3A1436558.md)

## How to review
Trace every request parameter to its sink and confirm the invariant: attacker-influenced data never reaches an interpreter as code or as a resolved name. Check that:
- The sink is not eval/new Function/const_get/require/autoload, or input is constrained to a fixed allowlist, not a regex on a name [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-20-github-pages-multiple-rces-via-kramdown-config-html.md).
- `const_get` lookups are namespaced; `require` paths are not derived from user strings [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-20-github-pages-multiple-rces-via-kramdown-config-html.md).
- Backend DSL scripting constructs are rejected, not just schema-typed [E4](https://bugbountylibrary.com/r/h1%3A3694007.md).
- Guard env vars are actually set in production, not assumed (sift's `CSP_ENABLED`) [E2](https://bugbountylibrary.com/r/h1%3A3782701.md).
- Parser JS/Lua engines are explicitly disabled for user content [E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review.md)[E8](https://bugbountylibrary.com/r/h1%3A1401444.md).
- Strings concatenated into executed JS are escaped or passed as data, not source [E5](https://bugbountylibrary.com/r/h1%3A1436558.md).
- Grep code and dependencies for `eval`, `new Function`, `const_get`, `require`, `loadstring`, `_script`; check default-on parser options.

## Variants seen
- Constant/class resolution via regex-validated name, plus traversal `require` [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-20-github-pages-multiple-rces-via-kramdown-config-html.md)
- Filter library `new Function` from GraphQL scalar [E2](https://bugbountylibrary.com/r/h1%3A3782701.md)
- Autoload include() via type-confused string param [E3](https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md)
- Backend script engine via raw sort string [E4](https://bugbountylibrary.com/r/h1%3A3694007.md)
- Native-to-page JS string concatenation with leaked tokens [E5](https://bugbountylibrary.com/r/h1%3A1436558.md)
- Markdown parser JS engine enabled [E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review.md)
- Lua sandbox escape via `loadstring` [E8](https://bugbountylibrary.com/r/h1%3A1401444.md)

## Impact and severity
Unauthenticated RCE in several cases, execution as the service account, secret leakage, and file read [E2](https://bugbountylibrary.com/r/h1%3A3782701.md)[E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review.md). Severity rises when the sink is reachable pre-auth, runs in a privileged process, or exposes deployment secrets.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-20-github-pages-multiple-rces-via-kramdown-config-html.md
- E2: https://bugbountylibrary.com/r/h1%3A3782701.md
- E3: https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd.md
- E4: https://bugbountylibrary.com/r/h1%3A3694007.md
- E5: https://bugbountylibrary.com/r/h1%3A1436558.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md
- E7: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review.md
- E8: https://bugbountylibrary.com/r/h1%3A1401444.md