CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreAuthenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)7.2 High
- moonshot ai kimi codeMoonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection5.3 Medium
- softaculous virtualizorSoftaculous Virtualizor OS Command Injection via Billing Module Handler9.3 Critical
- notepad-plus-plusNotepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog6.7 Medium
- projectdiscovery nucleiNuclei: Arbitrary Command Execution via DAST Code Signature Bypass4.7 Medium
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read9.4 Critical
- nvidia infrastructure controller, infra controller +1 moreNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause...8.0 High
- d-link dap-1360D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface9.3 Critical
- zohocorp manageengine adselfservice plusRemote code execution vulnerability9.8 Critical
- 1panel-dev maxkbMaxKB: Prompt-injectable agent can lead to command execution10.0 Critical
- 1panel-dev maxkbMaxKB AWS Bedrock model credential injection leads to remote code execution9.1 Critical
- openwrt luciluci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root8.8 High
- kubeedgeKubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes8.8 High
libemail-sender-perlUbuntu,perl-Email-SenderopenSUSE +1 moreEmail::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe9.8 Critical- kubeedgeKubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API8.8 High
- ntop ntopngntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API8.8 High
- dassault systèmes tuleap enterprise editionOS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.58.8 High
- temporal technologies, inc. serverTemporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host8.7 High
xiphosDebianAn issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the...7.8 High- james-heinrich getid3getID3 before 1.9.26 OS Command Injection via Unescaped Filenames8.7 High
- d-link r95D-Link R95 DHMAPI ssi system os command injection9.4 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.6.3 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.9 Critical
- ibm iIBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]5.4 Medium
- digint btrbkbtrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh8.7 High
- spatie scottyspatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection5.3 Medium
- ibm cloud pak for dataIBM Cloud Pak for Data is vulnerable to OS command injection8.8 High
- planet technology corp. igs-5225-8p2t4s v1, igs-5225-8p2t4s v2 +1 morePLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server8.7 High
- pypa virtualenvvirtualenv bash and fish activation scripts execute commands embedded in paths7.8 High
- pypa virtualenvvirtualenv: Command injection via --prompt in activate.bat (batch activator)7.3 High
- jabrefJabRef CAYW Sublime Text integration permits operating-system command injection7.5 High
- webrecorder browsertrixBrowsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors9.4 Critical
- dromara mayfly-goDromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection5.3 Medium
- midnightbsd mportmport package fetch and clean paths are vulnerable to TOCTOU filesystem races5.8 Medium
- cyclonedx cyclonedx-node-npm@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows8.5 High
- fatpipe ipvpn, mpvpn, warp +2 moreFatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100...9.8 Critical
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper...8.1 High
- No product listedThe ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with...8.8 High
- wwbn avideoAVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF8.7 High
- Show moreLoading…