CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- edimax ew-7478apcEdimax EW-7478APC POST Request formAccept os command injection5.3 Medium
- d-link dcs-935l, dlink dcs-935l firmware +1 moreD-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection8.7 High
- h.view hv-500s6 ip cameraH.VIEW HV-500S6 IP Camera OS Command Injection8.6 High
- kestra, kestra oss +1 moreKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`10.0 Critical
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++: Arbitrary Code Execution via config.xml commandLineInterpreter7.8 High
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection7.8 High
- shenzhen cudy technology co., ltd. lt300 3.0Cudy LT300 3.0 OS Command Injection via NTP Configuration8.7 High
@cyclonedx/cdxgennpm@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths6.9 Medium- dokkuDokku: OS Command Injection via app.json managed Cron9.0 Critical
- dokkuDokku: OS Command Injection via App Name in Git Pre-Receive Hook9.0 Critical
- dell container storage modulesDell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi...8.0 High
- filebrowserFile Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)9.3 Critical
- pnpmpnpm: Repository-controlled configDependencies can select a pacquet native install engine7.5 High
- schneider electric powerlogic™ p7, schneider-electric powerlogic p7 firmware +1 moreCWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection')...8.6 High
- dell display and peripheral managerDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper...7.8 High
- rapid7 insightconnect tcpdump plugin, insightconnect tcpdump +1 moreOS Command Injection in Rapid7 InsightConnect Tcpdump Plugin6.0 Medium
- rapid7 insightconnect traceroute plugin, insightconnect traceroute +1 moreOS Command Injection in Rapid7 InsightConnect Traceroute Plugin7.7 High
- rapid7 insightconnect awk plugin, insightconnect awk +1 moreOS Command Injection in Rapid7 InsightConnect AWK Plugin7.7 High
- rapid7 insightconnect finger plugin, insightconnect finger +1 moreOS Command Injection in Rapid7 InsightConnect Finger Plugin6.0 Medium
- rapid7 insightconnect translate, insightconnect tr plugin +1 moreOS Command Injection in Rapid7 InsightConnect Translate Plugin7.7 High
- rapid7 insightconnect ping plugin, insightconnect ping +1 moreOS Command Injection in Rapid7 InsightConnect Ping Plugin7.7 High
- gnu sed, rapid7 insightconnect sed plugin +1 moreOS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.8.8 High
- rapid7 insightconnect sqlmap plugin, insightconnect sqlmap +1 moreOS Command Injection in Rapid7 InsightConnect SQLmap Plugin6.0 Medium
- rapid7 insightconnect rpm plugin, insightconnect rpm +1 moreOS Command Injection in Rapid7 InsightConnect RPM Plugin6.0 Medium
- cactiCacti: Command Injection via escape_command() no-op in RRDtool execution8.6 High
- quest netvault backupQuest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability8.8 High
- cactiCacti: Unauthenticated RCE on Graph Image9.8 Critical
- unraidUnraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability8.8 High
- unraidUnraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability8.8 High
- fatpipe warpWarp branch selector command injection via Git branch names8.0 High
- fatpipe warpWarp: Linux external editor command injection7.8 High
- fatpipe warpWarp: Remote SSH cwd can lead to unauthorized remote command execution8.8 High
- fatpipe warpWarp: DCS lifecycle hook spoofing can alter terminal session metadata4.3 Medium
- fatpipe warpWarp: OS command injection when opening terminal links from WSL7.7 High
- fatpipe warpWarp: Command Injection via Warp code search tool arguments7.8 High
- jenkins git client, jenkins project git client plugin +1 moreJenkins Git client Plugin has an OS command injection vulnerability on agents5.0 Medium
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability9.1 Critical
- rtk-ai rtk, rtkai rtk-rewrite +1 more@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String6.3 Medium
- jdx misemise: Local credential_command executes untrusted config6.3 Medium
- jdx misemise: Arbitrary command execution via task-include files in an untrusted, config-less repository8.6 High
- wwbn avideoAVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink8.1 High
- netcomm nf20meshNetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection8.7 High
- nicolargo glancesGlances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py7.8 High
- tp link systems inc. archer mr402 v1, tp-link systems inc. archer c20 v5, archer c20 v6 +4 more +6 moreUnauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers8.7 High
- vimVim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename5.7 Medium
- coollabsio coolifycoollabsio coolify Image Name os command injection5.3 Medium
- comfast cf-wr631ax v3Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection5.3 Medium
- Show moreLoading…