Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
Medium 5.0
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements us…
-
Medium 4.7
ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode cause…
-
High 7.1
Nuclio: Kaniko build tempDir command injection
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the …
-
High 7.2
Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privil…
-
High 7.1
Unauthenticated Remote Command Execution in Management Component
A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility.
-
High 8.8
Authenticated Remote Command Injection in AOS-CX Web-based Management Interface
An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system.
-
High 7.2
Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface
Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to…
-
High 7.5
Unauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface
A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attac…
-
High 8.1
Unauthenticated Remote Code Execution in HPE Networking Fabric Composer API
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vu…
-
High 8.3
Unauthenticated Remote Code Execution during HPE Networking Fabric Composer Installation Process
A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successf…
-
High 8.8
Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API
A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromis…
-
High 8.8
FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing author…
-
High 8.8
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potenti…
-
High 7.2
LibreNMS before 26.5.0 Remote Code Execution via AboutController
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configura…
-
High 7.4
ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. Th…
-
Critical 9.9
Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection
A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients …
-
Critical 9.9
RedPort Optimizer wXa-223 System Clock datetime.php exec command injection
A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to c…
-
Critical 10.0
QVidium Opera11 CGI Script net_tr.cgi command injection
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated r…
-
Medium 6.6
Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection
A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The …
-
Medium 6.6
Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection
A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the att…
-
Critical 9.9
D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is …
-
Critical 9.1
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection
A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip…
-
Critical 9.1
D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection
A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be…
-
Critical 9.9
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection
A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in…
-
Critical 9.1
D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection
A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_share…
-
Medium 4.7
diem-project diem Administrative Console actions.class.php executeCommand os command injection
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argume…
-
High 7.3
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command …
-
High 7.4
TOTOLINK NR1800X cstecgi.cgi setUssd command injection
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit i…
-
High 7.4
D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection
A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injecti…
-
High 8.1CVE-2026-50979 Public exploit
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allo…
-
Medium 5.3
AlexGladkov claude-in-mobile client.ts execSync os command injection
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been…
-
High 8.6
LibreNMS: Remote Code Execution by Signal Alert Transportation Module
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before bein…
-
High 8.8
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary …
-
Medium 4.3
An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concate…
-
High 8.3
TOTOLINK N600R cstecgi.cgi getCurrentTime command injection
A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be i…
-
Medium 5.6
zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection…
-
Medium 6.8
NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative…
-
Medium 6.8
NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator c…
-
High 8.0
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privi…
-
Medium 6.3
FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The att…