CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- nagios host, xi +1 moreNagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability7.2 High
- nagios host, xi +1 moreNagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability7.2 High
- deciso opnsenseDeciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability6.8 Medium
- liquidpromptLiquid Prompt arbitrary command injection via crafted Git branch names in gitstatusd backend6.3 Medium
- utt hiper 520, 520 firmware +1 moreUTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection8.6 High
- utt hiper 520, 520 firmware +1 moreUTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection8.6 High
- lkw199711 smangaA Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php...9.8 Critical
- prolink prc2402mPROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command...10.0 Critical
- openclawOpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags2.0 Low
- bixat rustflyRustFly 2.0.0 Command Injection via UDP Remote Control9.3 Critical
- denoDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process8.1 High
- nestersoft worktime, nestersoft inc. worktime (on-prem/cloud) +1 moreUnauthenticated OS Command Injection in NesterSoft WorkTime9.8 Critical
- seccn dingcheng g10SECCN Dingcheng G10 session_login.cgi qq os command injection9.3 Critical
- sebhildebrandt systeminformation, red hat developer hub +1 moresysteminformation has Command Injection via Unsanitized `locate` Output in `versions()`8.8 High
- sebhildebrandt systeminformation, red hat developer hub +1 moreSysteminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path8.4 High
- mjdm majordomoMajorDoMo Command Injection in rc/index.php via Race Condition9.2 Critical
- advantech wise-6610-cb, wise-6610-eb, wise-6610-el-cb +10 more +12 moreAdvantech WISE-6610-NB Background Management openvpn_apply os command injection8.6 High
- openclawOpenClaw: Prevent shell injection in macOS keychain credential write7.6 High
- aquasec trivy action, aquasecurity trivy-action +1 moreTrivy Action has a script injection via sourced env file in composite action5.9 Medium
- wpcalc popup box – easily create wordpress popupsPopup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- openclawOpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling7.7 High
- openclawOpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist8.6 High
- openclawOpenClaw has a command injection in maintainer clawtributors updater8.6 High
- zoneminderZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application...9.8 Critical
- jishi node-sonos-http-apijishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection6.9 Medium
- tenable security center[R1] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.27.4 High
- openclawOpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes9.2 Critical
- openclawOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement9.2 Critical
- openclawOpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path7.1 High
- running-elephant datartAn issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter...8.8 High
- kalcaddle kodboxkalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection5.3 Medium
- yued-fe lulu uiyued-fe LuLu UI run.js child_process.exec os command injection6.9 Medium
- soliton filezenFileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is...8.7 High
- jm33-m0 emp3r0remp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)9.3 Critical
- arduino app lab, arduino-app-lab +1 moreArduino App Lab has Improper Data Validation in Internal Terminal Interface6.9 Medium
- No product listedgrub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS...5.4 Medium
- akutishevsky sf-mcp-serversf-mcp-server has a Command Injection in query_records tool due to unsafe use of child_process.exec7.5 High
- qnap media streaming add-onMedia Streaming add-on2.0 Low
- No product listedAn issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious...8.8 High
- karutoil catalystCatalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution10.0 Critical
- tp-link systems inc. tapo c260 v1, tp-link tapo c260 firmware +1 moreRemote Code Execution on TP-Link Tapo C260 by Guest User8.7 High
- axis osThe VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a...7.1 High
- d-link dcs-931l, dlink dcs-931l firmware +1 moreD-Link DCS-931L setSysAdmin os command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_filtering sub_4211C8 os command injection8.6 High
- utt 进取 521g, 521g firmware +1 moreUTT 进取 521G formPdbUpConfig sub_446B18 os command injection8.6 High
- great developers certificate generation system, greatdevelopers certificate +1 moreGreat Developers Certificate Generation System csv.php os command injection6.9 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_upnp sub_420618 os command injection8.6 High
- totolink wa300, wa300 firmware +1 moreTotolink WA300 cstecgi.cgi setAPNetwork os command injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_static_route_table sub_4175CC os command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Configuration set_dmz sub_4208A0 os command injection8.6 High
- Show moreLoading…