CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.8 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- evalstate fast-agent fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution 6.4 Medium
- geonode GeoNode: OS command injection via uploaded file layer name 8.8 High
- grobidorg grobid GROBID is vulnerable to OS command injection through crafted PDF filenames 0.0 None
- aws trusted-remote-execution OS command injection in the example SSM documents in Trusted Remote Execution (REX) 9.3 Critical
- jetbrains toolbox app In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration... 7.5 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted... 7.8 High
- fluxbox Fluxbox through 1.3.7 OS Command Injection via Style Background Values 8.5 High
- usermin Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion 7.7 High
- ag2ai ag2, autogen +1 more AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution 8.8 High
- signalwire freeswitch FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands 9.8 Critical
- tinyhumansai openhuman OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution 9.8 Critical
- ntop ntopng ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) 8.8 High
- agentscope-ai agentscope agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection 6.9 Medium
- shirasagi project shirasagi An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated... 8.7 High
- opnsense os-acme-client An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of... 9.4 Critical
- purocean yank note Purocean Yank Note Terminal index.ts checkPermission os command injection 5.3 Medium
- radare2 radare2: Remote code execution when loading Pebble/SMD binary 8.5 High
- tsparticles tsParticles: Generated release notes can execute shell commands in the stable publish workflow 7.5 High
- nvm-sh nvm nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases 2.1 Low
- linksys e5350 Linksys E5350 apply.cgi system os command injection 10.0 Critical
- linksys wrt54gl Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection 9.4 Critical
- linksys wrt54gl Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection 9.4 Critical
- zohocorp manageengine key manager plus Command injection vulnerability 8.8 High
- qihoo 360 d600-2, d603-2, d606-6 +2 more Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection 6.9 Medium
- qihoo 360 d600-2, d603-2, d606-6 +1 more +3 more Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 10.0 Critical
- tanium threat response Tanium addressed an unauthorized code execution vulnerability in Threat Response. 7.5 High
- tanium threat response Tanium addressed an unauthorized code execution vulnerability in Threat Response. 7.5 High
- tp-link systems inc. archer ax3000 v2 Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component 7.3 High
- red hat openshift gitops Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration 8.8 High
- jarun nnn nnn through 5.3 OS Command Injection via togglex Plugin 8.4 High
- azuracast AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() 8.7 High
- nagios enterprises xi Nagios XI < 2026R2 OS Command Injection via mibs.php 8.6 High
- zohocorp manageengine key manager plus Command injection vulnerability 8.1 High
- welotec tk100, tk500-v2, tk500-v3 +2 more Command Injection in Digital I/O 8.6 High
- welotec tk100, tk500-v2, tk500-v3 +2 more Command Injection in Management Control Functions 8.6 High
- No product listed An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS... 9.8 Critical
- temporal technologies, inc. server Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host 8.7 High
- No product listed Konflux-ci: unquoted variable expansion in shell command execution 6.7 Medium
- amlogic android sdk, nexbox a95x +1 more Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket 8.5 High
- control web panel web panel Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token 8.5 High
- control web panel web panel Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/ 8.5 High
- control web panel web panel Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API 8.5 High
- control web panel web panel Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory 8.7 High
- control web panel web panel Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor 8.7 High
- barracuda networks email security gateway (esg), load balancer application delivery controller (adc), message archiver (bma) +3 more +5 more OS Command Injection in Barracuda Appliances 8.6 High
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of... 8.0 High
- zohocorp manageengine eventlog analyzer, manageengine log360 +1 more Remote Code Execution 8.7 High
- zohocorp manageengine password manager pro, manageengine pam360 +1 more Remote Code Execution Vulnerability 8.8 High
- Show olderLoading…