CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- ibm app connect enterpriseIBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs7.8 High
- magicblack maccms10magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection5.1 Medium
- d-link dwr-m921D-Link DWR-M921 formWsc os command injection5.1 Medium
- d-link dwr-m921D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection5.1 Medium
- parallels desktop for macParallels Desktop local privilege escalation via appliance extract argument injection7.8 High
- d-link dwr-m921D-Link DWR-M921 formDiskCreateShare system os command injection9.4 Critical
- d-link dwr-m921D-Link DWR-M921 formDiskFormat system os command injection9.4 Critical
- d-link dwr-m920D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection9.4 Critical
- contec co., ltd. sv-cpt-mc310, sv-cpt-mc310f +1 moreSolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this...8.7 High
- contec co., ltd. can-2-usb, can-2-wf +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- contec co., ltd cps-tm341g5mb-adsc1-931, cps-tm341gmb-adsc1-931, cps-tm341mb-adsc1-931 +2 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- contec co., ltd. configurable type cps-pcs341[][]-ds1-1201, integrated type cps-pc341[][]-*-9201 +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- contec co., ltd. m2m controller configurable type cps-mcs341*, m2m controller integrated type cps-mc341, m2m gateway configurable type cps-mgs341* +1 more +3 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- contec co., ltd. sga1000Improper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- contec co., ltd. fxa3000, fxa3000-[][], fxa3020 +17 more +19 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.7 High
- 0x4m4 hexstrike ai0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection6.9 Medium
- ipa-lab hackingbuddygptipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection5.3 Medium
- 0x4m4 hexstrike ai0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection6.9 Medium
- gh05tcrew pentestagentGH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection6.9 Medium
- gh05tcrew pentestagentGH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection6.9 Medium
- openspug spugSpug through 3.4.0 Remote Code Execution via ping_check8.7 High
- webgjc web robotwebgjc web_robot web.py controller_recover os command injection5.3 Medium
- lb-link ac1900 firmwareA Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare...3.1 Low
- cisa malcolmOS Command Injection in Malcolm8.7 High
- aws projenOS command injection in the task synthesis component in projen8.4 High
- tubitak bilgem software technologies research institute pardus softwareOS Command Injection in TUBITAK BILGEM's Pardus Software8.4 High
- wavlink wn535m1, wavlink technology wn535m3 +1 moreWAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server9.3 Critical
- tubitak bilgem software technologies research institute pardus boot repairOS Command Injection in TUBITAK BILGEM's Pardus-boot-repair7.8 High
- perforce puppet enterpriseCommand Injection in Puppet Enterprise8.6 High
- tp-link systems inc. deco be11000 v2, deco m9 plus v2 +1 moreOS Command Injection Vulnerability in Deco Devices7.7 High
- argos-ci argos-javascriptArgos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core7.5 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards9.8 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- lenovo tianxi ai agent pc applicationA potential command injection vulnerability was reported in the Tianxi AI Agent PC Application,...8.4 High
- filerunFileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition8.6 High
- filerunFileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler8.7 High
- configserver security & firewall, webpros configserver security & firewall +1 moreOS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a...9.5 Critical
- configserver security & firewall, webpros configserver security & firewall +1 moreImproper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated...9.2 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...9.1 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...9.8 Critical
- icecoderICEcoder through 8.1 OS Command Injection via lib/properties.php8.7 High
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.14.7 Command Injection via distributionType8.5 High
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.14.7 Command Injection via Mix organization7.3 High
- Show moreLoading…