CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- universal robots polyscope 5Command injection in Dashboard Server interface9.8 Critical
- vimVim: OS Command Injection via 'path' completion4.6 Medium
- electermelecterm: RCE via malicious SSH server filename in openFileWithEditor7.8 High
- No product listedAn issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the ...7.3 High
- nokia broadcast message centerNokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do...6.5 Medium
- 8421bit miniclaw8421bit MiniClaw kernel.ts executeCognitivePulse os command injection5.3 Medium
- hitachi virtual storage platform one block 23, virtual storage platform one block 24, virtual storage platform one block 26 +2 more +4 moreOS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/288.1 High
- gotenbergGotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection9.8 Critical
node-ts-ocrnpmnode-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js8.8 High- getgrav gravGrav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection9.3 Critical
@evomap/evolvernpm@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts8.1 High- lobehubLobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)6.2 Medium
- totolink a8000ruTotolink A8000RU cstecgi.cgi setAppFilterCfg os command injection9.3 Critical
- No product listedThe GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD...9.1 Critical
- No product listedThe traceroute diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG...8.8 High
- No product listedThe ping diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and...8.8 High
- a-g-u-p-t-a wireshark-mcpA-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection6.9 Medium
- shenzhen yipu commercial and trading co., ltd wdr201a wifi extenderWDR201A WiFi Extender OS Command Injection via firewall.cgi9.3 Critical
- shenzhen yipu commercial and trading co., ltd wdr201a wifi extenderWDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)9.3 Critical
- shenzhen yipu commercial and trading co., ltd wdr201a wifi extenderWDR201A WiFi Extender OS Command Injection via makeRequest.cgi9.3 Critical
- shenzhen yipu commercial and trading co., ltd wdr201a wifi extenderWDR201A WiFi Extender OS Command Injection via internet.cgi9.3 Critical
- shenzhen yipu commercial and trading co., ltd wdr201a wifi extenderWDR201A WiFi Extender OS Command Injection via wireless.cgi9.3 Critical
- 3onedata gw1101-1d(rs-485)-tb-pShell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway9.3 Critical
- privsim mcp-test-runnerprivsim mcp-test-runner MCP index.ts child_process.spawn os command injection5.3 Medium
- geovision gv-lpc2011 firmware, gv-lpc2211 firmware, geovision inc. gv-lpc2011/lpc2211 +2 moreGeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability9.9 Critical
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection6.9 Medium
- r-huijts mcp-server-rijksmuseumr-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection5.3 Medium
- pskill9 website-downloaderpskill9 website-downloader MCP index.ts download_website os command injection5.3 Medium
- trendnet tew-821dap, tew-821dap firmware +1 moreTRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection5.3 Medium
- trendnet tew-821dap, tew-821dap firmware +1 moreTRENDnet TEW-821DAP tools_diagnostic os command injection5.1 Medium
- artmin96 yii2-mcp-serverArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection5.3 Medium
- sunwood-ai-labs command-executor-mcp-serverSunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection6.9 Medium
- eyal-gor p 69 branch monkey mcpeyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection6.9 Medium
- bitwarden cliBitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had...8.8 High
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi vulnerability os command injection9.3 Critical
- openstack ironic-python-agent, ironic python agent, red hat openshift container platform 4 +4 more +6 moreOpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere8.0 High
- hkuds openharnessHKUDS OpenHarness Remote Command Execution via /bridge Slash Command8.7 High
- aws amazon ecs agent, amazon ecs container agent +1 moreOS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials7.5 High
- synway smg gateway management softwareSynway SMG Gateway Management Software OS Command Injection via radius_address9.3 Critical
- pallets click click, red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8 +3 more +5 more[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"7.2 High
- vetcoders mcp-server-semgrepVetCoders mcp-server-semgrep MCP index.ts create_rule os command injection6.9 Medium
- burtthecoder mcp-dnstwistBurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection6.9 Medium
- polarvista xcode-mcp-serverPolarVista xcode-mcp-server MCP index.ts run_tests os command injection6.9 Medium
- tubitak bilgem software technologies research institute pardus os my computerOS Command Injection in TUBITAK BILGEM's Pardus OS My Computer8.8 High
- vimVim: OS Command Injection in netrw4.4 Medium
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection9.3 Critical
- Show moreLoading…