Remote code execution (RCE)
A flaw that lets someone across the network make your server run code they chose, with whatever access that process already has.
See it
What it is
Remote code execution means an attacker can make a target run code across a network boundary without already having local access. The entry point might be unsafe deserialization, command injection, a template engine, an upload that lands in an executable directory, or a vulnerable dependency. Log4Shell became infamous because a short jndi:ldap lookup string, pasted into a username or a User-Agent header, triggered a JNDI fetch that ran the attacker's code the moment the field was logged.
Reach for RCE as an impact description, not a root cause. The useful next question is always what primitive produces it and under which identity: a shell command, dynamic evaluation, native memory corruption, or loading an attacker-controlled class or plugin. That answer determines the patch and the blast radius.
Do not assume code execution means instant root access. The code starts with the permissions, network reach, filesystem access, and secrets of the compromised process. Containers and least privilege can sharply limit the damage, but they do not make RCE acceptable: that process may still hold customer data, production credentials, or a route deeper into the network.
Ask AI for it
Investigate and fix this suspected remote code execution path in an isolated Docker container. Trace the untrusted input from the network through deserialization, template rendering, child_process, eval, plugin loading, native bindings, and file execution until the exact code-running primitive is identified. Reproduce impact only by creating a harmless marker inside the disposable container, with outbound networking disabled and no real secrets mounted. Remove the primitive or upgrade the affected package to its fixed version, run the service as a non-root user with a read-only filesystem and dropped Linux capabilities, and add a regression test proving the original payload is treated as data and cannot create the marker.