https://blog.msnieman.com/tags/eval-injection/Recent content in Eval Injection on Myles Nieman — BlogHugoen-usSun, 22 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/interpreter/Sun, 22 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/interpreter/Mirth Connect 4.4.0 is vulnerable to CVE-2023-43208 (unauthenticated RCE); database credentials in mirth.properties lead to a PBKDF2-hashed password for the sedric user, and a root-owned Flask service using eval() on attacker-controlled f-strings enables arbitrary command execution as root.