CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +1 more +3 moreCups: cups: argument injection in mailto notifier via notify-recipient-uri2.5 Low
- cookpete auto-changelogauto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF8.4 High
- cjbassi gotopArgument Injection leading to arbitrary process termination in gotop4.8 Medium
- aws security-agent-mcp-serverArgument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace6.9 Medium
- aws aws-efs-csi-driverAWS EFS CSI Driver Mount Option Injection via mounttargetipmap6.9 Medium
- jupyterlabJupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs5.4 Medium
- simple-git project simple-git, steveukx git-js +1 moresimple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)8.1 High
- weblateorg weblateWeblate: Mercurial argument injection via repository filenames allows authenticated command execution8.5 High
- froxlorFroxlor before 2.3.12 Command Injection via letsencryptchallengepath9.4 Critical
- openclawOpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS8.5 High
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper8.6 High
- alastairlundy alastairlundy.cliinvoke, cliinvoke +1 moreCliInvoke: Argument Injection in Extensibility Runner Factory8.4 High
- webpros wp toolkit for cpanelArgument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated...9.4 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process6.6 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod9.9 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable3.1 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard3.1 Low
- proxmox pmg-apiIn Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval...4.4 Medium
- cohesity netbackup flex osPrivilege Escalation via Argument Injection in NetBackup Flex OS Shell9.4 Critical
- webrecorder browsertrixBrowsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors9.4 Critical
- nm-l2tp networkmanager-l2tpNetworkManager-l2tp Privilege Escalation via pppd Plugin Injection8.5 High
- appwriteAppwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter8.7 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Argument and connection-string injection via the database field in the Backup tool8.7 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools7.1 High
- nm-l2tp networkmanager-l2tpNetworkManager-l2tp Privilege Escalation via pppd Username Injection8.5 High
- netcore nr255-vNetcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters8.6 High
- netcore nr255-vNetcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths8.7 High
- shaneisrael fireshareFireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite9.8 Critical
- fedora extra packages for enterprise linux (epel), fedora +1 moreNetworkManager-l2tp: local privilege escalation via ipsec.conf injection7.8 High
- hkuds nanobotHKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection6.9 Medium
- parallels desktop for macParallels Desktop local privilege escalation via appliance extract argument injection7.8 High
- paessler prtg network monitorPRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server...2.7 Low
- paessler prtg network monitorPRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML...2.7 Low
- cole aiosmtplibaiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses6.3 Medium
- aws projenOS command injection in the task synthesis component in projen8.4 High
- tubitak bilgem software technologies research institute pardus penArgument Injection in TUBITAK BILGEM's Pardus Pen3.3 Low
- palo alto networks cortex xdr broker vmCortex XDR Broker VM: Privilege Escalation Vulnerability4.8 Medium
- schneider electric ecostruxure™ it data center expert (formerly known as struxureware data center expert)CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')...8.6 High
- gitpython-developers gitpythonGitPython 3.1.59 Local File Content Oracle via --no-index7.1 High
- nfriedly bestzipbestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination8.6 High
- okta privileged access clientImproper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument5.0 Medium
- hitachi cosminexus component containerCommand Argument Injection Vulnerability in Cosminexus Component Container9.8 Critical
- mikrotik routerosSSH session privilege manipulation via a crafted username in Mikrotik RouterOS9.2 Critical
- cyanheads git-mcp-servergit-mcp-server 2.15.1 Argument Injection via Git Ref Parameters8.7 High
- gfi software clearview, exinda ai +1 moreGFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client7.1 High
- openvpnAn argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on...7.7 High
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited...6.5 Medium
- powsybl powsybl-corePowSyBl: Command Injection in LocalCommandExecutor-s7.1 High
- wazuhWazuh: Missing input validation in multiple active response scripts allows argument injection7.1 High
- mongodb c# driver, c\# driver +1 moreConnection-option injection via unescaped settings in the canonical MongoDB URL builder7.1 High
- Show moreLoading…