CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- electronElectron: AppleScript injection in app.moveToApplicationsFolder on macOS6.5 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi vpn_drop os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi vpn_connect os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi ping_test os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi edit os command injection5.3 Medium
- trendnet tew-657brm, tew-657brm firmware +1 moreTrendnet TEW-657BRM setup.cgi add_wps_client os command injection5.3 Medium
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection8.7 High
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection8.7 High
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection8.7 High
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection8.7 High
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection8.7 High
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection8.7 High
- endian firewall, firewall community +1 moreEndian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection8.7 High
- progress flowmonUnintended command execution during report generation in Progress Flowmon8.7 High
- progress sharefile storage zones controllerRCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)9.1 Critical
- mb connect line mbconnect24, mymbconnect24 +1 moreMB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray7.2 High
- mervinpraison praisonaiPraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox8.8 High
- kubeaiKubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods8.7 High
- mervinpraison praisonaiPraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()9.8 Critical
- mervinpraison praisonai, praison praisonaiagents +1 morePraisonAI: Shell Injection in run_python() via Unescaped $() Substitution7.8 High
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access7.3 High
- jlowin fastmcpFastMCP has a Command Injection vulnerability - Gemini CLI6.7 Medium
- nvidia jetson linux, jetson xavier series, jetson orin series and jetson thor +1 moreNVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical...7.6 High
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreCommand Injection in mlflow/mlflow9.6 Critical
- cato networks socketCato's Socket WebUI is vulnerable to OS Command Injection8.3 High
- basercmsbaserCMS: OS Command Injection in the baserCMS Update Functionality9.1 Critical
- basercmsbaserCMS: OS command injection vulnerability in installer9.2 Critical
- basercmsbaserCMS: OS Command Injection Leading to Remote Code Execution (RCE)9.1 Critical
- ridvay auto-approval moduleRidvay Code's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- No product listedDSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- ridvay auto-approval moduleRidvay Code's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- tokfinity infcodeInfCode's terminal auto-execution module contains a critical command filtering vulnerability that...7.8 High
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreVim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in...9.2 Critical
- nicolargo glancesGlances Vulnerable to Command Injection via Dynamic Configuration Values7.8 High
- raine consult-llm-mcpraine consult-llm-mcp server.ts child_process.execSync os command injection4.8 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys8.8 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreCommand Injection in mlflow/mlflow10.0 Critical
- totolink a3300r, a3300r firmware +1 moreTotolink A3300R Parameter cstecgi.cgi setLanCfg command injection5.3 Medium
- nsa ghidraNSA Ghidra Auto-Analysis Annotation Command Execution8.8 High
- xiongmai dvr/nvr devicesIn Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command...8.8 High
- njzjz wenxianwenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`9.8 Critical
- dedeveloper23 codebase-mcpDeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection4.8 Medium
- elecv2 elecv2pelecV2 elecV2P rpc pm2run os command injection6.9 Medium
- kazuph mcp-docs-ragkazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection4.8 Medium
- gematik authenticator, app-authenticator +1 moreAuthenticator vulnerable to Remote Code Execution7.8 High
- com.ritense.valtimo web, pi-hole web interface +1 morePi-hole Web Interface has a Command Injection Vulnerability8.9 High
- flannel-io flannelFlannel vulnerable to cross-node remote code execution via extension backend BackendData injection7.5 High
- fleetdm fleetFleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts5.7 Medium
- nec aterm wx1500hp firmware, aterm wx3600hp firmware, nec platforms, ltd. aterm wx1500hp +1 more +3 moreOS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to...7.1 High
- nec aterm gb1200pe firmware, aterm wf1200cr firmware, aterm wg1200cr firmware +15 more +17 moreOS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to...7.1 High
- Show moreLoading…