CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- jtescher image optimizerimage_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format9.3 Critical
- enmaso @enmaso/node-convert@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo9.3 Critical
- tzwm ppt2pngppt2png through 0.0.6 OS Command Injection via input and output paths9.3 Critical
- openstack mistralIn OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied...8.7 High
- iskratel innboxIskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter9.3 Critical
- openfind secushare proOpenfind｜SecuShare Pro - OS Command Injection9.3 Critical
- brocade fabric os, broadcom fabric operating system +1 moreAn OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session...5.4 Medium
- brocade fabric os, broadcom fabric operating system +1 moreAn OS command injection vulnerability exists in the account management subsystem of Brocade...5.4 Medium
- brocade fabric os, broadcom fabric operating system +1 moreA command injection vulnerability exists in the WebTools administrative interface handling...8.5 High
- brocade fabric os, broadcom fabric operating system +1 moreAn OS command injection vulnerability exists in the REST API management interface of Brocade...8.5 High
- broadcom fabric operating system, brocade fabric os +1 moreBrocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download...7.0 High
- brocade fabric os, broadcom fabric operating system +1 moreAn OS command injection vulnerability exists in the time and zone management subsystem of Brocade...8.6 High
- brocade fabric os, broadcom fabric operating system +1 moreAn OS command injection vulnerability exists in the configuration management subsystem of Brocade...7.3 High
- brocade fabric os, broadcom fabric operating system +1 moreA local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric...8.5 High
- brocade fabric os, broadcom fabric operating system +1 moreAn OS command injection vulnerability exists in maintenance command-line diagnostic utilities on...7.0 High
- brocade fabric os, broadcom fabric operating system +1 moreMultiple OS Command Injection vulnerabilities exist in the management interface and session...8.6 High
- brocade fabric os, broadcom fabric operating system +1 moreA command injection vulnerability in the REST API management interface of Brocade Fabric OS...8.5 High
- cisco license on-premCisco Smart Software Manager On-Prem Command Injection Vulnerability4.9 Medium
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 moreBackstage: Configuration bypass in TechDocs mkdocs.yml sanitization7.7 High
- sonicwall sma1000Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...7.8 High
- gitaheadGitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript8.7 High
- gitaheadGitAhead through 2.7.1 OS Command Injection via Git Filter Filenames7.7 High
- wummel patoolpatool before 4.0.6 OS Command Injection on Windows via shell_quote_nt8.5 High
- rundeckRundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting7.7 High
- bugtracker.netImproper Neutralization of Special Elements used in an OS Command in BugTracker.NET7.5 High
- openprinting cupsCUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip3.3 Low
- arista networks cloudvision cueSecurity Advisory 01908.6 High
- dell openmanage integrationDell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0,...8.8 High
- microsoft simplechatSimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)8.8 High
- microsoft ufoMicrosoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`9.1 Critical
- microsoft ufoMicrosoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app8.8 High
- felisify information technologies industry and trade inc. sambaboxOS Command Injection in Felisify Informatics' SambaBox8.8 High
- progress software autonomous rest connector genai agentsOS command injection in Progress Software Autonomous REST Connector GenAI Agents9.6 Critical
- microsoft lrzszlrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode7.7 High
- rengineyogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection5.3 Medium
- totolink x6000rTOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection10.0 Critical
nxnpm,@rootio/nxRoot +1 moreNx: OS command injection via git revisions and remote refs8.5 High- langflow-ai langflowLangflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server9.9 Critical
- langflow-ai langflow, langflow-base, lfx +2 moreLangflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration9.9 Critical
- penpotPenpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color9.9 Critical
- chainguard academy (edu)Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands2.1 Low
- ahsay ahsaycbs, cloud backup suite +1 moreAhsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection10.0 Critical
- hkuds vibe-tradingHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool8.7 High
- digi international anywhereusb plus family, connect ez family, connect it family +9 more +11 moreOS Command Injection in Digi Accelerated Linux (DAL OS)9.4 Critical
- aws sagemaker-distributionOS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio9.3 Critical
- nrwl nxNx: OS command injection in the @nx/docker release pipeline7.3 High
- webpros cpanel, wp squared +1 moreInsufficient validation allows arbitrary commands to be executed via the Multilang adminbin.9.9 Critical
- johnson controls easyio fs32- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection....7.2 High
- johnson controls easyio fs32- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. ...5.6 Medium
- tp-link systems inc. archer ax90 v1TDDPv2 setProductVer Command Injection in Archer AX907.7 High
- Show moreLoading…