Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
Critical 9.9
Authenticated OS Command Injection in Danfoss AK-EM100
The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
-
High 7.3
Snowflake Connector vulnerable to Command Injection
snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establish…
-
High 7.3CVE-2023-34233 Public exploit
Snowflake Python Connector vulnerable to Command Injection
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-on(SSO) browser URL auth…
-
High 7.3
Snowflake NodeJS Driver vulnerable to Command Injection
snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21. In order to exploit the potential for command injection, an attacker would need to b…
-
High 7.3
Snowflake Golang Driver vulnerable to Command Injection
gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on (SSO) browser URL authentication. In order to exploit the potential for command injection, an attack…
-
High 7.5
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to…
-
Critical 9.8
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMwar…
KEV Jun 22, 2023 -
High 8.8
D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.
-
High 8.8
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabil…
KEV Jun 16, 2025 -
Critical 9.8
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw par…
-
Critical 9.8
An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network…
-
High 8.8
There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If a…
-
Critical 9.8CVE-2023-33532 EPSS 16%
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker g…
-
High 8.8
Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.2…
-
Critical 9.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
-
High 7.2
Remote Code Execution via Command Injection
Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2…
-
Critical 9.8
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vu…
-
Critical 9.8
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpMod…
-
High 8.8
EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pp…
-
Critical 9.8
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiag…
-
Medium 6.9
Physical access to the WDM enables use of USB device to gain access to the WDM
An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue a…
-
High 7.5
Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is…
-
High 7.8
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:v…
-
Medium 5.5
An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary d…
-
Medium 5.9
An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3…
-
High 7.8
n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function
All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability t…
-
High 8.4
keep-module-latest vulnerable to Command Injection due to missing input sanitization
All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. **Note:** To execute the code snippet and potentially exploit the …
-
High 8.4
bwm-ng vulnerable to command injection
All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to hav…
-
Critical 9.8
ruby-saml vulnerable to XPath injection
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
-
High 7.2
A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could all…
-
High 7.2
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gai…
-
High 8.8
Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characte…
-
High 7.2
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gai…
-
High 7.2
MXsecurity Command Injection Vulnerability
MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted s…
-
High 7.2CVE-2023-31742 Public exploit
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attac…
-
High 8.8
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted …
-
Critical 9.8
TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
-
High 8.8
TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd.
-
High 8.8
TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove.
-
High 7.8
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:lat…