Remote Code Execution

Remote Code Execution (RCE) is the most severe vulnerability class because it gives an attacker full control over the server process and, in cloud environments, a pivot point to the rest of the infrastructure. RCE can arise from OS command injection, unsafe eval, unvalidated deserialization, or sandbox escape — different root causes that share the common outcome of arbitrary code running server-side.

RCE is hard to catch in review because the dangerous sink is often a framework primitive that is legitimate in other contexts — eval() in a sandbox implementation, child_process.exec() in a build tool, or deserialize() in a session handler. The dangerous property is not the function itself but the fact that its argument can be influenced by an attacker.

PullLight flags eval(), Function(), child_process.exec/spawn calls where any argument contains a user-influenced value, deserialization calls on untrusted data, and sandbox implementations that use vm.compile or similar mechanisms — the exact pattern behind the jsonpath-plus sandbox escape (CVE-2024-21534).