Security

Code Injection

A vulnerability class (CWE-94) in which improperly controlled input is incorporated into code that the application then generates or evaluates, letting an attacker run instructions of their choosing. It is the weakness Microsoft assigned to the SharePoint flaw CVE-2026-65660.

Deep dive

Learn Article

How .NET Deserialization Turns Attacker Data Into Code Execution

Deserialization is safe until the format can name types and call methods. A walk through how attacker-controlled bytes become a gadget chain and then running code, and how to design so they cannot.

intermediate 5 min read

Back to glossary