CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- elecom co.,ltd. wrc-be65qsd-b, wrc-be72xsd-b, wrc-be72xsd-ba +1 more +3 moreELECOM wireless LAN access point devices contain an OS command injection in processing of...9.3 Critical
- elecom co.,ltd. wrc-be65qsd-b, wrc-be72xsd-b, wrc-be72xsd-ba +1 more +3 moreELECOM wireless LAN access point devices contain an OS command injection vulnerability in...8.6 High
- claris filemaker cloudA Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console...7.2 High
- efwgrp efw4.xefw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution9.3 Critical
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreInconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreInconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI7.2 High
- microsoft visual studio codeVisual Studio Code Elevation of Privilege Vulnerability8.8 High
- fortinet fortiap, fortiap-w2 +1 moreAn improper neutralization of special elements used in an os command ('os command injection')...6.5 Medium
- fortinet fortiap, fortiap-u, fortiap-w2 +2 moreAn improper neutralization of special elements used in an OS command ("OS Command Injection")...6.1 Medium
- dragonmonk111 junoclawJunoClaw: plugin-shell shell-metacharacter injection via shell wrapper8.4 High
- dragonmonk111 junoclawJunoClaw: plugin-shell shell-injection bypass via substring blocklist8.4 High
- hahwul dalfoxDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode10.0 Critical
- protobufjs protobuf.js, protobufjs project protobufjs-cli +1 moreprotobufjs-cli: OS Command Injection7.8 High
- ivanti virtual traffic managerOS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote...7.2 High
- dell insightiq, powerscale insightiq +1 moreDell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of...8.2 High
- siemens ruggedcom rox mx5000, ruggedcom rox mx5000re, ruggedcom rox rx1400 +19 more +21 moreA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM...8.9 High
- siemens ruggedcom rox mx5000, ruggedcom rox mx5000re, ruggedcom rox rx1400 +19 more +21 moreA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM...7.7 High
- zyxel wre6505 v2 firmware, wre6505 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel...8.8 High
- cribl edgeLocal privilege escalation to SYSTEM in Cribl Edge for Windows8.5 High
- cribl edgeLocal privilege escalation in Cribl Edge for Linux8.5 High
- No product listedThe TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a...9.8 Critical
- openjsf webdriverio, red hat hardened images +1 moreWebdriverIO has Command Injection in the BrowserStack Service9.8 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout8.7 High
- bentomlBentoML: Dockerfile command injection via envs[*].name in bentofile.yaml8.8 High
- bentomlBentoML: Dockerfile command injection via docker.base_image8.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +11 more +13 moreCockpit: cockpit: arbitrary command execution via crafted links in system logs ui8.0 High
- d-link dns-320, dlink dns-320 firmware +1 moreD-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection5.1 Medium
- d-link dns-320, dlink dns-320 firmware +1 moreD-Link DNS-320 webfile_mgr.cgi chown os command injection5.1 Medium
- d-link dns-320, dlink dns-320 firmware +1 moreD-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection5.1 Medium
- tenda ac6, ac6 firmware +1 moreTenda AC6 httpd getLogFile get_log_file os command injection5.1 Medium
- tenda ac6, ac6 firmware +1 moreTenda AC6 httpd WifiApScan formWifiApScan os command injection5.3 Medium
- tenda ac6, ac10u firmware +1 moreTenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection5.1 Medium
- tenda ac6, ac6 firmware +1 moreTenda AC6 httpd telnet os command injection5.1 Medium
gpt-pilotPyPIGPT-Pilot contains a command injection vulnerability in the Executor.run() method6.5 Mediumautomagik-genienpmautomagik-genie has a command injection vulnerability8.1 High- 8421bit miniclaw8421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection5.1 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 login.cgi sys_login1 os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 wireless.cgi WifiBasic os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 wireless.cgi advance os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 adm.cgi wzdapMesh os command injection5.3 Medium
- industrial application software ias canias erpIndustrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 adm.cgi wzdap os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 adm.cgi wifi_region os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 adm.cgi wan os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 adm.cgi wzdrepeater os command injection5.3 Medium
- wavlink nu516u1, wl-nu516u1 firmware +1 moreWavlink NU516U1 adm.cgi change_wifi_password os command injection5.3 Medium
- hikvision ds-3e1310p-si, ds-3e1318p-si, ds-3e1326p-si +2 moreSome Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated...7.2 High
@profullstack/mcp-servernpm@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module9.8 Critical- termix-ssh termixTermix: OS Command Injection in Docker Container Management Endpoints9.9 Critical
- draytek vigor 2960DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi9.2 Critical
- Show moreLoading…