CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- tp-link system inc. tl-wr841n v14Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration8.5 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-hammer_cli: command injection via insecure editor invocation6.7 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: command injection in foreman-tail5.3 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: command injection in foreman-rake database tasks8.2 High
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: command injection in foreman-rake errors:fetch_log via request_id parameter8.2 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter8.8 High
- fortra boks managerFortra BoKS Manager crlserver command injection vulnerability9.1 Critical
- genians, inc genian ssl pns (xenics auther)Genians, Inc Genian SSL PNS OS Command Injection8.4 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Local Privilege Escalation7.8 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core OS Command Injection7.2 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core OS Command Injection8.8 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core OS command injection7.2 High
- denoland denoDeno 2.7.0 through 2.9.7 Command Injection via node:child_process9.2 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute...8.8 High
- zosmaai pi-llm-wikizosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection9.4 Critical
- 0xshariq github-mcp-server0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection5.3 Medium
- hkuds anytoolHKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection6.9 Medium
- pfu limited image scanner driver for linux (fi series), image scanner driver for linux (sp series) +1 moreImage Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who...5.4 Medium
- beenuar aisocAiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR9.4 Critical
- No product listedDeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool...9.8 Critical
- anjvision yssd-rtmp-h5Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H58.7 High
- steveukx git-jssimple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection9.2 Critical
- simple-git project simple-git, steveukx git-js +1 moresimple-git unsafe-operation guard does not block trailer command configuration9.2 Critical
- simple-git project simple-git, steveukx git-js +1 moresimple-git allows command execution through unblocked Git configuration includes8.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.1 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.5 High
- akauntingAkaunting before 2.1.31 OS Command Injection via app alias8.7 High
- weblateorg weblateWeblate: Mercurial argument injection via repository filenames allows authenticated command execution8.5 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Command Injection in the Alert Script Plugin8.8 High
- esengine deepseek-reasonixImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix7.8 High
- shell-quoteshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token9.2 Critical
- netcore nap930Netcore NAP930 Network Tools CGI network_tools eval os command injection10.0 Critical
- raspap raspap-webguiRaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection5.3 Medium
- raspap raspap-webguiRaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection5.1 Medium
- No product listedmbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool ...6.3 Medium
- brainstorm force convertplusConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter8.8 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated API generatedocs Host Command Injection8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreAuthenticated Command Injection in FreePBX UCP Interface8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module7.7 High
- watchguard apWatchGuard AP Authenticated Command Injection in Diagnostic CLI8.6 High
- watchguard apWatchGuard AP Command Injection in Internal Management API Allows Command Execution9.3 Critical
- netcore nr289-geNetcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection10.0 Critical
- netcore nr289-geNetcore NR289-GE Location Time location_time.cgi system os command injection10.0 Critical
- extegrity exam4macOS Exam4 Local Privilege Escalation via Command Injection7.8 High
code-ollamanpmcode-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)7.8 High- netcore nr289-geNetcore NR289-GE CGI ap_ip.cgi system os command injection10.0 Critical
- red hat openshift data foundation 4Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal7.2 High
- suse neuvectorOS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes8.8 High
- apache karafApache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)8.8 High
- Show moreLoading…