CWE-470

• CWE ID
• 470

• CWE Name
• Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

• CWE Abstraction
• Base

• CWE structure
• Simple

• CWE Status
• Draft

The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that