CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- wavlink wn551x3-aWAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection10.0 Critical
- wavlink wn551x3-aWAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection10.0 Critical
- wavlink wn536ax6-aWAVLINK WN536AX6-A protocol.csp host_black os command injection9.4 Critical
- wavlink wn536ax6-aWAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection10.0 Critical
- wavlink wn536ax6-aWAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection10.0 Critical
- wavlink wn536ax6-aWAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection10.0 Critical
- wavlink wn536ax6-aWAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection10.0 Critical
- shanghai xi yu ji zhi technology minimax codeShanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection5.1 Medium
- wavlink wn553x1-bWAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection9.4 Critical
- wavlink wn701aeWAVLINK WN701AE ioos Web Backend del_vlan_group os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B ioos sub_416B50 os command injection9.4 Critical
- wavlink wn553x1-bWAVLINK WN553X1-B ioos Service sub_416D88 os command injection9.4 Critical
- wavlink wn701aeWAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection9.4 Critical
- wavlink wl-wn530hg4bWAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection9.4 Critical
- wavlink wn579x3-dWAVLINK WN579X3-D wapi.cgi port_forward os command injection9.4 Critical
- wavlink wl-wn579a3-aWAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection10.0 Critical
- softiron hypercloudSoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields7.4 High
- mqttsnet thinglinksThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks9.9 Critical
- pi-holePi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass7.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier9.4 Critical
- zuke-build zukeZuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line7.0 High
- tenda w18eCVE-2026-1182387.2 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of...8.8 High
- No product listedCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup8.4 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of...7.2 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of...7.2 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of...8.8 High
- opnsense coreOPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting8.6 High
- dahua intelligent connection centerDahua Intelligent Connection Center command injection9.8 Critical
- @nx gradle, maven, nrwl nx +2 moreNx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle7.3 High
- rapid7 insight agentRapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path7.8 High
- progress software ws ftp serverOS Command Injection in Progress WS_FTP Server9.9 Critical
- progress software ws ftp serverCommand Injection via FTP Notification Variables in Progress WS_FTP Server9.0 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities4.3 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- yamaha corporation nwr100Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection...9.3 Critical
- sindresorhus open, anomalyco opencode, mcpjam inspector +2 moreopen 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows7.7 High
- hashgraph guardian, nozomi networks cmc +1 moreAuthenticated RCE in update functionality in Guardian/CMC before 26.4.07.5 High
- nvm-sh nvmnvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed7.1 High
- apereo foundation openequellaUnrestricted Command Execution via system.execute9.4 Critical
- wwbn avideo-encoderAVideo-Encoder: unauthenticated command execution through streamer login trust10.0 Critical
- volmarg personal-management-systemVolmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path8.6 High
- giuspen cherrytreeCherryTree through 1.7.2 OS Command Injection via Custom Web Link Action7.1 High
- wso2 business process server, enterprise integrator (bps profile) +1 moreRemote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution8.8 High
- ultralyticsUltralytics torch_safe_load Command Injection Remote Code Execution Vulnerability7.8 High
- alpine ilx-f511Alpine iLX-F511 diagapp Command Injection Vulnerability6.8 Medium
- juniper networks session smart conductor, session smart router +1 moreSession Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration8.8 High
- Show moreLoading…