CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- smci as-2115hs-tnrSupermicro BMC's SMTP service contains a command injection vulnerability7.2 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreVPN Command Injection Vulnerability8.5 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreMissing Per-Instruction Authorization Checks9.4 Critical
- red hat multicluster engine for kubernetes, enterprise linux 10, enterprise linux 6 +16 more +18 moreNetworkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend6.7 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreInstruction Injection via FieldX MDM10.0 Critical
- cloud foundry foundation bosh directorReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(...8.7 High
- cloud foundry boshPackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, ...8.7 High
- No product listedAn undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03...9.6 Critical
- No product listedAn issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain...8.2 High
- No product listedThe network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is...9.8 Critical
- No product listedAn OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas...9.8 Critical
- devolutions server, mariadb, red hat enterprise linux 10 +6 more +8 moreMariaDB server has unsafe parameter handling in `wsrep_notify_cmd`10.0 Critical
- devolutions server, mariadb, red hat enterprise linux 7 +6 more +8 moreMariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side8.0 High
- devolutions server, mariadb, red hat enterprise linux 10 +5 more +7 moreMariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)8.0 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.0 High
- hiraishikentaro wezterm-mcphiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection5.3 Medium
- No product listedphp-censor Webhook Endpoint GitBuild.php os command injection6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection6.9 Medium
- zhayujie chatgpt-on-wechatzhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection6.9 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion7.8 High
- dokployDokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint9.9 Critical
- dokployDokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement9.0 Critical
- dokployDokploy: Schedule Authorization Bypass Enables Host/Server Command Execution9.9 Critical
- dokployDokploy: Command Injection in /docker-container-logs Endpoint9.9 Critical
- dokployDokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)8.8 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...7.5 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.5 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- jelmer dulwichDulwich Vulnerable to Command Injection via Merge Driver Path7.7 High
- scadabrScadaBR Authenticated Remote Code Execution9.9 Critical
- zedZed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions8.6 High
- zedZed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions8.6 High
- zedZed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config8.6 High
- zedZed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)8.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command7.0 High
- microsoft ufoOS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON7.8 High
- tanium connectTanium addressed an unauthorized code execution vulnerability in Connect.8.8 High
- mcdope pam usbpam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent8.2 High
- mcdope pam usbpam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution7.8 High
- mcdope pam usbpam_usb: Command injection via $TMUX environment variable leads to RCE as root8.8 High
- sherlock-project sherlockSherlock: Command Injection via pull_request_target in validate_modified_targets.yml9.3 Critical
- Show moreLoading…