# Parser token injection into code execution

Parsers that eval, exec, or serialize attacker tokens; check escaping, length fields, and log directives

_Area: Web injection and code execution. Seen in 3 disclosed reports; 3 confirmed bounties, median $20,000, range $1,250-$33,510; latest 2023-11-10. Updated 2026-10-24._

## How it works
A parser treats part of its input as data but a downstream consumer treats it as code or protocol structure. The assumption that breaks is that a parsed fragment is inert: a string is later `eval`'d, a length field is trusted to match the string, or a log line is scanned for control directives. When attacker data reaches that consumer unescaped or with a mismatched length, the boundary between data and instruction collapses and the crafted token executes.

## Where it shows up
- `eval`/`exec` on strings derived from parsed file content (annotations, quoted tokens) [E3](https://bugbountylibrary.com/r/h1%3A1154542.md)
- Protocol serializers computing bulk-string length from an object method (`bytesize`/`to_s`) that untrusted input can override [E1](https://bugbountylibrary.com/r/h1%3A1679624.md)
- Watchdog/process managers that regex-scan stdout/stderr for JSON or directives [E2](https://bugbountylibrary.com/r/blog%3Amaxwelldulin-com-blogpost-stdout-cosmos-sdk-rce.md)
- Log sinks using `sprintf %s` with attacker data in the leading format string rather than escaped key/value pairs [E2](https://bugbountylibrary.com/r/blog%3Amaxwelldulin-com-blogpost-stdout-cosmos-sdk-rce.md)
- Libraries that dynamically define methods from untrusted JSON keys [E1](https://bugbountylibrary.com/r/h1%3A1679624.md)

## How to review
Trace each attacker-controlled token to every consumer. The invariant: a parsed value must never be interpreted as code, and any length/escaping metadata must be computed from the actual bytes, not from an overridable method. Check that eval targets are constant or fully escaped, that serializers derive lengths from the real string, and that log parsers only accept directives from a trusted channel. For Perl, verify escaping survives backslash-newline, which can defeat end-of-string anchors [E3](https://bugbountylibrary.com/r/h1%3A1154542.md).

## Variants seen
- Object method override feeding Redis RESP length, chaining to `Marshal.load` [E1](https://bugbountylibrary.com/r/h1%3A1679624.md)
- Unescaped log string injecting fake upgrade JSON into a stdout watcher [E2](https://bugbountylibrary.com/r/blog%3Amaxwelldulin-com-blogpost-stdout-cosmos-sdk-rce.md)
- DjVu annotation `eval` with backslash-newline escaping bypass [E3](https://bugbountylibrary.com/r/h1%3A1154542.md)

## Why fixes fail
E1 shows a prior patch covering only one caching path; the same Sawyer-to-Redis flow remained reachable elsewhere, so the fix was incomplete until all sinks were covered.

## Impact and severity
All three yielded remote code execution (or DoS) on servers processing untrusted input, with bounties up to ~$33.5k. Severity rises when the parser runs as a privileged service user and when one injection chains into deserialization [E1](https://bugbountylibrary.com/r/h1%3A1679624.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1679624.md
- E2: https://bugbountylibrary.com/r/blog%3Amaxwelldulin-com-blogpost-stdout-cosmos-sdk-rce.md
- E3: https://bugbountylibrary.com/r/h1%3A1154542.md