CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- smci x14dbg-dap,x14dbiSupermicro SMASH service contain an Arbitrary code execution issue8.8 High
- umijs umiumijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection5.1 Medium
- No product listedjsforce SFDX Connection Registry sfdx.js _execCommand os command injection4.8 Medium
- qusetions minicode-pythonQUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection2.3 Low
- autel maxicharger single, maxicharger single charger firmware +1 moreCommand Injection via Malicious OCPP Server9.5 Critical
- autel maxicharger single, maxicharger single charger firmware +1 moreUnauthenticated Command Injection10.0 Critical
- tenable security centerCommand Injection8.7 High
- tenable security centerCommand Injection9.4 Critical
- gitpython-developers gitpythonGitPython before 3.1.51 Command Injection via option prefix abbreviation8.7 High
- gitpython-developers gitpythonGitPython 3.1.50 Authentication Bypass via Joined Short Options9.3 Critical
- tenable security centerCommand Injection9.4 Critical
- canonical accountsserviceaccountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts7.8 High
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: information disclosure via proxycommand %r username expansion3.9 Low
- zyxel ax7501-b1 firmwareA post-authentication command injection vulnerability in the "LogServer" field of the syslog...7.2 High
- No product listedAn issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09...9.8 Critical
- wwbn avideoAVideo before 29.0 OS Command Injection via execAsync9.3 Critical
- rvc-boss gpt-sovitsGPT-SoVITS 20250606v2pro OS Command Injection via webui.py9.3 Critical
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated RCE in system_certificates view8.6 High
- ibm langflow oss, langflow +1 moreLangflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints8.8 High
- ibm engineering ai hubMultiple Vulnerabilities in IBM Engineering AI hub.5.4 Medium
- No product listeddjango-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send...9.1 Critical
- arcadedata arcadedbArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts8.6 High
- pheditorPheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection8.8 High
- pheditorAuthenticated terminal command whitelist bypass in Pheditor8.8 High
- lenovo xclarity integrator for microsoft windows admin centerThe Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on...8.8 High
- wwbn avideoAVideo through 29.0 OS Command Injection via ffmpeg.json.php9.2 Critical
- wwbn avideoAVideo through 29.0 OS Command Injection via listFFmpegProcesses9.2 Critical
- x-rite ma-t6Origin Validation Error in X-Rite MA-T69.8 Critical
- sebhildebrandt systeminformationsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux8.7 High
- wekanWekan: Shell Injection via Avatar Upload9.9 Critical
- maaassistantarknightsMaaAssistantArknights: PR-title expression injection in release-preparation.yml8.8 High
- decolua 9router9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments8.8 High
- nocobaseNocoBase backup restore schema name allows command injection6.7 Medium
- aws jsiiOS command injection in jsii-diff in AWS jsii8.4 High
- eugeny tabbyTabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)7.8 High
- mervinpraison praisonaiPraisonAI before 1.6.78 Remote Code Execution via SkillTools8.6 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox7.0 High
- adobe animate, animate 2023, animate 2024 +2 moreAnimate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)8.2 High
- adobe animate, animate 2023, animate 2024 +2 moreAnimate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)7.7 High
- tp-link archer vx1800v firmware, tp-link systems inc. archer vx1800v v1 +1 moreOS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v8.5 High
- tp-link systems inc. archer vx1800v v1, tp-link archer vx1800v firmware +1 moreOS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v8.6 High
- dan-in-ca sip, sustainable irrigation platform +1 moreSustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection9.2 Critical
- apache kylinApache Kylin: OS Command Injection via Async Query API9.8 Critical
- milestone systems xprotect management server, siemens siveillance video v2023 r3, siveillance video v2024 r1 +1 more +3 moreRemote Code Execution by administrative user on the Management Server6.4 Medium
- checkmk gmbh checkmkmk_sap_hana: Privilege escalation via crafted sapstartsrv process name5.2 Medium
- louisho5 picobotlouisho5 picobot exec Tool exec.go ExecTool.Execute os command injection4.8 Medium
- vitec flamingoVitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php9.3 Critical
- vitec flamingoVitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php9.3 Critical
- evbee dc-80Comnand injection in OCPP ReserveLogin message8.6 High
- shibby tomatoShibby Tomato CIFS Mount sub_2D048 os command injection5.3 Medium
- Show moreLoading…