CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 Web Configuration adv_routing.php os command injection8.6 High
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 DMZ Host Feature adv_firewall.php os command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X DDNS Service set_ddns os command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_qos sub_420688 os command injection8.6 High
- xixianliang harmonyos-mcp-server, harmonyos mcp server +1 moreXixianLiang HarmonyOS-mcp-server input_text os command injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_ac_status os command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Configuration Parameter set_server_settings os command injection8.6 High
- shenzhen tenda technology tenda g300-f, tenda g300-f firmware +1 moreTenda G300-F Command Injection via formSetWanDiag8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_language os command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_mac_clone os command injection5.1 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_password os command injection5.1 Medium
- openprojectCommand Injection on OpenProject repositories leads to Remote Code Execution9.4 Critical
- beyondtrust privileged remote access, remote support (rs) and privileged remote access (pra), remote support +1 more +3 moreRemote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)9.9 Critical
- blakeblackshear frigateFrigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape9.1 Critical
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Web Management set_ac_server os command injection5.1 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_ipv6 sub_424D20 os command injection5.1 Medium
- devcode openstamanagerOpenSTAManager has an OS Command Injection in P7M File Processing9.4 Critical
- anthropic claude code, anthropics claude-code +1 moreClaude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions7.7 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection7.7 High
- gogsGogs's update .git/config file allows remote command execution9.3 Critical
- edimax ew-7438rpn mini firmware, edimax technology ew-7438rpn mini +1 moreEdimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution9.3 Critical
- wcchandler pingerPinger 1.0 - Remote Code Execution9.3 Critical
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +1 more +3 moreA post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI...7.2 High
- group-office group office, intermesh groupoffice +1 moreGroup-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler9.4 Critical
- openclawOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply8.4 High
- coding-solo godot-mcp, godot mcp +1 moreGodot MCP is vulnerable to Command Injection via unsanitized projectPath7.8 High
- n8nn8n Vulnerable to Command Injection in Community Package Installation9.4 Critical
- n8nn8n is Vulnerable to OS Command Injection in Git Node9.4 Critical
- chainguard melangemelange affected by potential host command execution via license-check YAML mode patch pipeline7.8 High
- chainguard melangemelange pipeline working-directory could allow command injection7.8 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code has a Command Injection in find Command Bypasses User Approval Prompt7.7 High
- anthropic claude code, anthropics claude-code +1 moreCluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes7.7 High
- hcl aionHCL AION is susceptible to Potential Command Injection vulnerability4.5 Medium
- elecom co.,ltd. wrc-x1500gs-b, wrc-x1500gsa-b, elecom wrc-x1500gs-b firmware +14 more +16 moreOS command injection vulnerability exists in WRC-X1500GS-B and WRC-X1500GSA-B. A crafted request...8.6 High
- brocade fabric os, broadcom fabric operating system +1 moreInformation disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.08.2 High
- frangoteam fuxaFUXA allows Remote Code Execution (RCE) via the project import functionality.9.8 Critical
- openclawOpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand7.8 High
- clawdbot, openclaw +1 moreAuthenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable8.8 High
- signalk signal k server, signalk-server +1 moreRCE - Command Injection in Signal K set-system-time plugin10.0 Critical
- tp-link systems inc. archer be230 v1.2, deco be25 v1.0, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.08.6 High
- tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware +1 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.28.5 High
- tp link systems inc. archer ax73 v2, tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 and AX738.5 High
- tp-link systems inc. archer be230 v1.2, tp link systems inc. archer ax53 v1.0, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.08.5 High
- tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware +1 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.28.5 High
- tp-link system inc. archer be230 v1.2, tp link systems inc. archer be3600 v1, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v18.5 High
- tp link systems inc. archer axe75 v2, tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v28.5 High
- tp-link systems inc. archer axe75 v1, archer be230 v1.2, tp link systems inc. archer ax10 v3 +2 more +4 moreAuthenticated Command Injection Vulnerability in Surfshark VPN Login in multiple Archer products8.5 High
- tp link systems inc. axe75 v1.0, tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.08.5 High
- tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware, tp-link systems inc archer be3600 v1 +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v18.5 High
- nokia ontInsufficient Input Validation on WEBUI in Nokia ONT/Beacon product8.0 High
- Show moreLoading…