CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 2.7 Low
- jetbrains datalore In JetBrains Datalore before 2026.3 command execution was possible in the database task container... 6.3 Medium
- jetbrains datalore In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container... 7.5 High
- openai codex desktop for windows, codex desktop for windows (microsoft store/msix package) +1 more Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows... 8.0 High
- ntop ntopng ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) 8.8 High
- iterm2 iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler,... 8.7 High
- nvm-sh nvm nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files 4.6 Medium
- securepoint ssl vpn client v2 Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows 6.9 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of... 4.6 Medium
- arsmotorin dreamdisplays Dream Displays has command-line argument injection in yt-dlp invocation 8.7 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name 7.1 High
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of... 7.2 High
- @nx gradle, maven, nrwl nx +2 more Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle 7.3 High
- progress software ws ftp server OS Command Injection in Progress WS_FTP Server 9.9 Critical
- progress software ws ftp server Command Injection via FTP Notification Variables in Progress WS_FTP Server 9.0 Critical
- zimbra collaboration suite Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection 7.8 High
- lxc incus Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options 9.0 Critical
- apache software foundation traffic server Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration 10.0 Critical
- argoproj argo-cd Argo CD: A Kustomize remote ref can run commands in the repo-server 9.9 Critical
- vitejs launch-editor, vite, vite-plus +2 more launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 6.3 Medium
- python pillow Pillow: Argument Injection in Ghostscript call, potentially leading into RCE 9.2 Critical
- anthropics claude-agent-sdk-python Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution 9.2 Critical
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 more Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method 3.3 Low
- 5rahim seanime Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings 5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 more Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass 7.8 High
- gitpython-developers gitpython GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name 8.7 High
- gitpython-developers gitpython GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec 9.2 Critical
- hestiacp HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking 9.9 Critical
- gitea Gitea external renderer argument injection and code execution 7.5 High
- vnotex vnote VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling 7.0 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 more Windows Error Reporting Service Elevation of Privilege Vulnerability 7.8 High
- jfrog jfrog-cli Potential command execution on the host running JFrog CLI. 9.0 Critical
- marcopiovanello yt-dlp-web-ui yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method 6.9 Medium
- netcore nr268 Netcore NR268 DDNS DDNSset.cgi execvp argument injection 9.4 Critical
- david-crty databasement databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g.,... 8.8 High
- sumatrapdfreader sumatrapdf SumatraPDF — Windows command-line argument injection in AI selection-translate 7.1 High
- sumatrapdfreader sumatrapdf SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors 7.1 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 more Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 2.7 Low
- ibm security verify access, verify identity access, security verify access container +1 more +3 more Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 8.8 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 more Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 8.8 High
- ilias-elearning e.v. ilias ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename 8.7 High
- infoblox nios Authenticated argument injection in NIOS command line leading to privilege escalation 9.1 Critical
- webpros wp toolkit Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other... 8.5 High
- brocade fabric os, broadcom fabric operating system +1 more An argument injection vulnerability exists in the configuration management command-line utility... 8.4 High
- brocade fabric os, broadcom fabric operating system +1 more An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9... 8.5 High
- microsoft ufo Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection 7.5 High
- microsoft ufo Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool 5.4 Medium
- microsoft ufo Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app 8.8 High
-
nxnpm,@rootio/nxRoot +1 more Nx: OS command injection via git revisions and remote refs 8.5 High - Show olderLoading…