CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- buffalo inc. wex-g300, wsr-300hp +1 moreBUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings...8.6 High
- aapanel baotaaaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection9.3 Critical
- aapanel baotaaaPanel BaoTa Database Backup database.py InputSql os command injection9.3 Critical
- netcore nbr200v2Netcore NBR200V2 Tools Ping network_tools system os command injection9.4 Critical
- netcore nbr200v2Netcore NBR200V2 Web Management network_tools eval os command injection10.0 Critical
- totolink n150rtTOTOLINK N150RT Web Management formWlSiteSurvey system os command injection9.4 Critical
- fleetdm fleetFleet Homebrew Cask OS Command Injection via Metadata8.9 High
- denisidoro navinavi through 2.24.0 OS Command Injection via Cheatsheet Variables7.3 High
- azuracastAzuraCast before 0.23.8 Command Injection via Streamer Username8.7 High
- openclawOpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome8.7 High
- openclawOpenClaw before 2026.8.1 Command Injection via Escaped Newlines8.6 High
- wikimedia foundation mediawiki - externaldata extensionUnauthenticated remote code execution through wikitext in ExternalData10.0 Critical
- alastairlundy cliinvoke.specializationsCliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers8.4 High
- gnome networkmanager-sstpNetworkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields7.8 High
- gnome networkmanager-iodineNetworkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection7.8 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- misp misp-modulesmisp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values6.3 Medium
- maple media root browser classicMaple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames8.5 High
- jhen0409 react-native-debuggerjhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection5.3 Medium
- eufy omni c20, omni x10 pro +1 moreOS command injection in Eufy Omni C20, Omni X10 Pro9.0 Critical
- honeywell pd45 industrial printerAuthenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface8.8 High
- honeywell pd45 industrial printerUnauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.0100409.8 Critical
- termix-ssh termixTermix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email9.1 Critical
- termix-ssh termixTermix: Command injection in SSH key deployment verification6.6 Medium
- dokployDokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root9.9 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)7.8 High
- papercut ng/mfPaperCut NG/MF: Remote Code Execution via Scan2Fax7.3 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software9.8 Critical
- brocade sannavInsufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a8.6 High
- webpros plesk extension "site import"OS command injection in Plesk allows remote authenticated users to execute arbitrary code with...9.4 Critical
- openc3 cosmosOpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting8.8 High
- cisco cloudCloud - Critical - Remote code execution - SA-CONTRIB-2026-1776.4 Medium
- frictionlessdata frictionless-pyFrictionless OS Command Injection via explore Console Command8.6 High
- zohocorp manageengine opmanagerRemote Code Execution vulnerability9.9 Critical
- zohocorp manageengine opmanager, manageengine firewall analyzer +1 moreCommand Injection vulnerability8.8 High
- changing cgservisignChanging｜CGServiSign - OS Command Injection8.6 High
- acer nitrosense v5MQTT WebSocket Command Execution Vulnerability in NitroSense6.1 Medium
- openeye apex network video recorder (nvr)OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection...7.2 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- Show moreLoading…