In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
Refactor the code to avoid dynamic variable evaluation whenever possible.
Use only allowlists of acceptable variable or function names.
For function names, ensure that you are only calling functions that accept the proper number of arguments, to avoid unexpected null arguments.
Our security experts can help you identify and remediate CWE-627 vulnerabilities in your codebase.
Get Security Assessment