CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- hanwha vision qnd-8080r, hanwhavision knb-2000 firmware, knb-5000n firmware +251 more +253 moreCommand Injection8.5 High
- jackwrichards fastlymcpjackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection6.9 Medium
- zyxel ex3301-t0 firmware, am7510-00 firmware, ax7501-b1 firmware +42 more +44 moreA post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP...7.2 High
- zyxel dx3300-t0 firmware, ax7501-b0 firmware, ax7501-b1 firmware +33 more +35 moreA post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel...6.8 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection9.3 Critical
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras OS Command Injection7.3 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi CsteSystem os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi CsteSystem os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection9.3 Critical
- tenda hg3, hg3 firmware +1 moreTenda HG3 formCountrystr os command injection8.7 High
- tenda hg3, hg3 firmware +1 moreTenda HG3 formgponConf os command injection8.7 High
- japan computer emergency response team coordination center (jpcert/cc) logontracerAn OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may...8.7 High
- choieastsea simple-openstack-mcpchoieastsea simple-openstack-mcp server.py exec_openstack os command injection6.9 Medium
- agentdeskai browser-tools-mcpAgentDeskAI browser-tools-mcp browser-connector.ts os command injection6.9 Medium
- intina47 context-syncIntina47 context-sync Git Integration git-integration.ts os command injection6.9 Medium
- toowiredd chatgpt-mcp-serverToowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection6.9 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection9.3 Critical
- gitpython-developers gitpythonGitPython: Command injection via Git options bypass8.8 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +5 more +7 moreLiteLLM: Authenticated command execution via MCP stdio test endpoints8.7 High
- linksys mr9600, mr9600 firmware +1 moreLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection8.6 High
- google gemini-cli, run-gemini-cli, google cloud gemini cli +1 more +3 moreUnauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows10.0 Critical
- siyuan-note siyuanSiYuan Desktop Notification XSS Leads to Electron RCE8.8 High
- vimVim: Command injection via backtick expansion in tag filenames6.6 Medium
- roxy-wiRoxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint7.4 High
- th30d4y openlearnxOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment8.8 High
- radareorg radare2-mcp, radare radare2 mcp server +1 moreradare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass9.3 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- totolink a3300r firmwareAn issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to...9.8 Critical
- ibm total storage service console (tssc) / ts4500 imc, total storage service console, ts4500 imc +2 moreTSSC/IMC is vulnerable to OS Command Injection7.3 High
- evomap evolverEvolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution9.8 Critical
- radare radare2radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names8.4 High
- atlassian bamboo, bamboo data center +1 moreThis Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0...9.4 Critical
- freepbx apiFreePBX api module Command Injection via GraphQL8.6 High
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreCommand Injection Vulnerability in Quantum Networks Router QN-I-4708.7 High
- newsoft newsoftoaNewSoft｜NewSoftOA - OS Command Injection9.3 Critical
- Show moreLoading…