CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- khyrenz parseusbsparseusbs < 1.9 Command Injection via Crafted LNK Filename8.5 High
- idachev mcp-javadcidachev mcp-javadc HTTP os command injection6.9 Medium
- shopify tophatTophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link6.3 Medium
- tp-link systems inc. ax53 v1.0, tp-link archer ax53 firmware +1 moreOS Command Injection Vulnerability in dnsmasq Module in TP-Link AX538.5 High
- tp-link systems inc. ax53 v1.0, tp-link archer ax53 firmware +1 moreOS Command Injection Vulnerability in OpenVPN Module in TP-Link AX538.5 High
- fleetdm fleetFleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit7.8 High
- coolercontrol coolercontroldImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold8.2 High
skilletonnpmskilleton has improper input handling in repository/path processing6.9 Medium- suvarchal docker-mcp-serversuvarchal docker-mcp-server HTTP index.ts pull_image os command injection6.9 Medium
- dbt-labs dbt-coredbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output9.3 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +3 more +5 moreCockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection9.8 Critical
- filebrowserFile Browser has a Command Injection via Hook Runner7.5 High
- nationalsecurityagency emissaryEmissary has a Command Injection via PLACE_NAME Configuration in Executrix7.2 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection8.8 High
- nokia mantaray nmAn OS Command Injection vulnerability in Nokia MantaRay NM8.0 High
- beijing topsec network security technology co., ltd. tianxin internet behavior management systemTianxin Internet Behavior Management System Command Injection via toQuery.php9.3 Critical
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans8.8 High
- totolink a7100ruTotolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU cstecgi.cgi setFirewallType os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU cstecgi.cgi setRemoteCfg os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU cstecgi.cgi setNtpCfg os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU cstecgi.cgi setDdnsCfg os command injection6.9 Medium
- amazon research and engineering studio, aws research and engineering studio (res) +1 moreAWS Research and Engineering Studio (RES) FileBrowser Command Injection7.7 High
- amazon research and engineering studio, aws research and engineering studio (res) +1 moreCommand Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)8.7 High
- totolink a3300rTotolink A3300R cstecgi.cgi vsetTr069Cfg os command injection5.1 Medium
- totolink a7100ruTotolink A7100RU cstecgi.cgi setScheduleCfg os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU cstecgi.cgi CsteSystem os command injection6.9 Medium
- aperisolveAperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer Command9.3 Critical
- offis dcmtkOFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection6.9 Medium
- chrischinchilla vale-mcpChrisChinchilla Vale-MCP HTTP index.ts os command injection4.8 Medium
- braffolk mcp-summarization-functionsBraffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection4.8 Medium
- utt 520w firmwareA remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT...6.8 Medium
- elgentos magento2-dev-mcpelgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection4.8 Medium
- nor2-io heim-mcpNor2-io heim-mcp new_heim_application tools.ts registerTools os command injection4.8 Medium
- tenda ac10, ac10 firmware +1 moreTenda AC10 httpd formAddMacfilterRule os command injection5.3 Medium
- scrapegraphai scrapegraph-aiScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection5.3 Medium
- moussaabbadla code-screenshot-mcpMoussaabBadla code-screenshot-mcp HTTP os command injection5.3 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad has Improper Neutralization of Special Elements used in an OS Command8.8 High
- vim, red hat ai inference server 3.2, ai inference server 3.3 +26 more +28 moreVim modeline bypass via various options affects Vim < 9.2.02768.2 High
- prosoft technology icx35-hwc cellular gateway, prosoft-technology icx35-hwc firmware +1 moreProSoft Technology ICX35-HWC Command Injection via Web Interface9.3 Critical
- bentomlBentoML: command injection in cloud deployment setup script (deployment.py)7.8 High
- infiniflow ragflowRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component8.7 High
- nationalsecurityagency emissaryEmissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix8.8 High
- amazon athena odbc driver, athena odbc +1 moreOS command injection in Amazon Athena ODBC driver on Linux7.3 High
- budibaseBudibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step9.1 Critical
- budibaseBudibase: Command Injection in Bash Automation Step8.7 High
- Show moreLoading…