CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setLedCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection9.3 Critical
- chatboxai chatboxchatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection6.9 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setAppCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection9.3 Critical
- 1panel-dev maxkb1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection5.3 Medium
- chargepoint home flex, home flex cph50 firmware +1 moreChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability7.5 High
- aws-mcp-serveraws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability9.8 Critical
- aws-mcp-serveraws-mcp-server Command Injection Remote Code Execution Vulnerability9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: Critical RCE via `type: job` workflow YAML9.8 Critical
- chamilo lms, chamilo-lms +1 moreOS Command Injection in Chamilo LMS 1.11.369.1 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection9.3 Critical
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root8.4 High
- juniper virtual lightweight collector, juniper networks jsi lwc +1 moreJSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root8.4 High
- mervinpraison praisonaiagentsPraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection9.3 Critical
- openclawOpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment5.8 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection9.3 Critical
- deepwisdom metagptFoundationAgents MetaGPT terminal.py Bash.run os command injection6.9 Medium
- deepwisdom metagptFoundationAgents MetaGPT common.py get_mime_type os command injection6.9 Medium
- deepwisdom metagptFoundationAgents MetaGPT terminal.py Terminal.run_command os command injection6.9 Medium
openclawnpmOpenClaw Host-Exec Environment Variable Injection5.9 Medium- openclawOpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection5.8 Medium
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection9.3 Critical
- totolink a7100ruTotolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection9.3 Critical
- d-link dir-882, dlink dir-882 firmware +1 moreD-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection8.6 High
- agions taskflow-aiAgions taskflow-ai terminal_execute handlers.ts os command injection5.3 Medium
- mervinpraison praisonaiImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai9.7 Critical
- tclahr uacUAC < 3.3.0-rc1 Command Injection via Placeholder Substitution8.5 High
- khyrenz parseusbsparseusbs < 1.9 Command Injection via Volume Path Argument8.4 High
- Show moreLoading…