# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection](https://agentprime.io/advisories/CVE-2026-5854.md)
  `CVE-2026-5854` · CVE record: Totolink A7100RU · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [awwaiid mcp-server-taskwarrior vulnerable to command injection](https://agentprime.io/advisories/GHSA-95hg-3c55-xf9x.md)
  `GHSA-95hg-3c55-xf9x`, `CVE-2026-5833` · npm `mcp-server-taskwarrior`: affected `<=1.0.1`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Other injection, Command injection
- [Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection](https://agentprime.io/advisories/CVE-2026-5853.md)
  `CVE-2026-5853` · CVE record: Totolink A7100RU · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection](https://agentprime.io/advisories/CVE-2026-5852.md)
  `CVE-2026-5852` · CVE record: Totolink A7100RU · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection](https://agentprime.io/advisories/CVE-2026-5851.md)
  `CVE-2026-5851` · CVE record: Totolink A7100RU · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection](https://agentprime.io/advisories/CVE-2026-5850.md)
  `CVE-2026-5850` · CVE record: Totolink A7100RU · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection](https://agentprime.io/advisories/CVE-2026-5844.md)
  `CVE-2026-5844` · CVE record: D-Link DIR-882 · CVSS 8.6 High · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts](https://agentprime.io/advisories/GHSA-3xp3-pr8x-f755.md)
  `GHSA-3xp3-pr8x-f755`, `CVE-2026-5831` · npm `taskflow-ai`: affected `<2.1.9`, fixed in `2.1.9` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31170.md)
  `CVE-2026-31170` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: Command injection
- [UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution](https://agentprime.io/advisories/CVE-2026-40032.md)
  `CVE-2026-40032` · CVE record: tclahr UAC · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [parseusbs < 1.9 Command Injection via Volume Path Argument](https://agentprime.io/advisories/CVE-2026-40030.md)
  `CVE-2026-40030` · CVE record: khyrenz parseusbs · CVSS 8.4 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [parseusbs < 1.9 Command Injection via Crafted LNK Filename](https://agentprime.io/advisories/CVE-2026-40029.md)
  `CVE-2026-40029` · CVE record: khyrenz parseusbs · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [idachev mcp-javadc HTTP os command injection](https://agentprime.io/advisories/CVE-2026-5802.md)
  `CVE-2026-5802` · CVE record: idachev mcp-javadc · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link](https://agentprime.io/advisories/CVE-2026-39862.md)
  `CVE-2026-39862` · CVE record: Shopify tophat · CVSS 6.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit](https://agentprime.io/advisories/GHSA-rphv-h674-5hp2.md)
  `GHSA-rphv-h674-5hp2`, `CVE-2026-27806`, `GO-2026-5634` · Go `github.com/fleetdm/fleet/v4`: affected `<4.81.1`, fixed in `4.81.1` · CVSS 7.8 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53](https://agentprime.io/advisories/CVE-2026-30818.md)
  `CVE-2026-30818` · CVE record: TP-Link Systems Inc. AX53 v1.0 · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53](https://agentprime.io/advisories/CVE-2026-30815.md)
  `CVE-2026-30815` · CVE record: TP-Link Systems Inc. AX53 v1.0 · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold](https://agentprime.io/advisories/CVE-2026-5208.md)
  `CVE-2026-5208` · CVE record: CoolerControl coolercontrold · CVSS 8.2 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [Emissary has a Command Injection via PLACE_NAME Configuration in Executrix](https://agentprime.io/advisories/GHSA-6c37-7w4p-jg9v.md)
  `GHSA-6c37-7w4p-jg9v`, `CVE-2026-35581` · Maven `gov.nsa.emissary:emissary`: affected `<8.39.0`, fixed in `8.39.0` · CVSS 7.2 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [Emissary has GitHub Actions Shell Injection via Workflow Inputs](https://agentprime.io/advisories/GHSA-3g6g-gq4r-xjm9.md)
  `GHSA-3g6g-gq4r-xjm9`, `CVE-2026-35580` · Maven `gov.nsa.emissary:emissary`: affected `<8.39.0`, fixed in `8.39.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [skilleton has improper input handling in repository/path processing](https://agentprime.io/advisories/GHSA-5g3j-89fr-r2vp.md)
  `GHSA-5g3j-89fr-r2vp` · npm `skilleton`: affected `<0.3.1`, fixed in `0.3.1` · CVSS 4.0, no score published · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection, Denial of service
- [File Browser has a Command Injection via Hook Runner](https://agentprime.io/advisories/GHSA-jvpw-637p-h3pw.md)
  `GHSA-jvpw-637p-h3pw`, `CVE-2026-35585`, `GO-2026-5481` · Go `github.com/filebrowser/filebrowser/v2`: affected `<2.33.8`, fixed in `2.33.8` · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [suvarchal docker-mcp-server HTTP index.ts pull_image os command injection](https://agentprime.io/advisories/CVE-2026-5741.md)
  `CVE-2026-5741` · CVE record: suvarchal docker-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection
- [dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output](https://agentprime.io/advisories/CVE-2026-39382.md)
  `CVE-2026-39382` · CVE record: dbt-labs dbt-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection
- [Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection](https://agentprime.io/advisories/CVE-2026-4631.md)
  `CVE-2026-4631` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection
- [Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection](https://agentprime.io/advisories/CVE-2026-35521.md)
  `CVE-2026-35521` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection
- [Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection](https://agentprime.io/advisories/CVE-2026-35520.md)
  `CVE-2026-35520` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection
- [Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection](https://agentprime.io/advisories/CVE-2026-35519.md)
  `CVE-2026-35519` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection
- [Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection](https://agentprime.io/advisories/CVE-2026-35518.md)
  `CVE-2026-35518` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection
- [Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection](https://agentprime.io/advisories/CVE-2026-35517.md)
  `CVE-2026-35517` · CVE record: pi-hole FTL · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Other injection
- [An OS Command Injection vulnerability in Nokia MantaRay NM](https://agentprime.io/advisories/CVE-2025-24818.md)
  `CVE-2025-24818` · CVE record: Nokia MantaRay NM · CVSS 8.0 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection
- [An OS Command Injection vulnerability in Nokia MantaRay NM](https://agentprime.io/advisories/CVE-2025-24817.md)
  `CVE-2025-24817` · CVE record: Nokia MantaRay NM · CVSS 8.0 High · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection
- [Tianxin Internet Behavior Management System Command Injection via toQuery.php](https://agentprime.io/advisories/CVE-2021-4473.md)
  `CVE-2021-4473` · CVE record: Beijing Topsec Network Security Technology Co., Ltd. Tianxin Internet Behavior Management System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection
- [Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans](https://agentprime.io/advisories/GHSA-rxpj-7qvf-xv32.md)
  `GHSA-rxpj-7qvf-xv32`, `BIT-activemq-2026-34197`, `CVE-2026-34197` · Maven `org.apache.activemq:activemq-all` and 1 more: affected `<5.19.5 || >=6.0.0, <6.2.3`, fixed in `5.19.5`, `6.2.3` · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Code injection, CWE-20
- [Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection](https://agentprime.io/advisories/CVE-2026-5692.md)
  `CVE-2026-5692` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A7100RU cstecgi.cgi setFirewallType os command injection](https://agentprime.io/advisories/CVE-2026-5691.md)
  `CVE-2026-5691` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection](https://agentprime.io/advisories/CVE-2026-5690.md)
  `CVE-2026-5690` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A7100RU cstecgi.cgi setNtpCfg os command injection](https://agentprime.io/advisories/CVE-2026-5689.md)
  `CVE-2026-5689` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection](https://agentprime.io/advisories/CVE-2026-5688.md)
  `CVE-2026-5688` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [AWS Research and Engineering Studio (RES) FileBrowser Command Injection](https://agentprime.io/advisories/CVE-2026-5709.md)
  `CVE-2026-5709` · CVE record: AWS Research and Engineering Studio (RES) · CVSS 7.7 High · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)](https://agentprime.io/advisories/CVE-2026-5707.md)
  `CVE-2026-5707` · CVE record: AWS Research and Engineering Studio (RES) · CVSS 8.7 High · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection](https://agentprime.io/advisories/CVE-2026-5679.md)
  `CVE-2026-5679` · CVE record: Totolink A3300R · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection](https://agentprime.io/advisories/CVE-2026-5678.md)
  `CVE-2026-5678` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Totolink A7100RU cstecgi.cgi CsteSystem os command injection](https://agentprime.io/advisories/CVE-2026-5677.md)
  `CVE-2026-5677` · CVE record: Totolink A7100RU · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Aperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer Command](https://agentprime.io/advisories/CVE-2026-34977.md)
  `CVE-2026-34977` · CVE record: Zeecka AperiSolve · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Vim modeline bypass via various options affects Vim < 9.2.0276](https://agentprime.io/advisories/CVE-2026-34982.md)
  `CVE-2026-34982` · CVE record: vim vim · CVSS 8.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection](https://agentprime.io/advisories/CVE-2026-5663.md)
  `CVE-2026-5663` · CVE record: OFFIS DCMTK · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [ChrisChinchilla Vale-MCP HTTP index.ts os command injection](https://agentprime.io/advisories/CVE-2026-5621.md)
  `CVE-2026-5621` · CVE record: ChrisChinchilla Vale-MCP · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection](https://agentprime.io/advisories/CVE-2026-5619.md)
  `CVE-2026-5619` · CVE record: Braffolk mcp-summarization-functions · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [@elgentos/magento2-dev-mcp vulnerable to command injection](https://agentprime.io/advisories/GHSA-xqv9-qr76-hfq2.md)
  `GHSA-xqv9-qr76-hfq2`, `CVE-2026-5603` · npm `@elgentos/magento2-dev-mcp`: affected `<=1.0.2`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [@nor2/heim-mcp vulnerable to command injection](https://agentprime.io/advisories/GHSA-wx4p-jr66-jfp9.md)
  `GHSA-wx4p-jr66-jfp9`, `CVE-2026-5602` · npm `@nor2/heim-mcp`: affected `<=0.1.3`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.](https://agentprime.io/advisories/CVE-2026-31067.md)
  `CVE-2026-31067` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.](https://agentprime.io/advisories/CVE-2026-31059.md)
  `CVE-2026-31059` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Apr 2026 · Tags: Command injection
- [Tenda AC10 httpd formAddMacfilterRule os command injection](https://agentprime.io/advisories/CVE-2026-5547.md)
  `CVE-2026-5547` · CVE record: Tenda AC10 · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Command injection
- [ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection](https://agentprime.io/advisories/CVE-2026-5532.md)
  `CVE-2026-5532` · CVE record: ScrapeGraphAI scrapegraph-ai · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Command injection
- [MoussaabBadla code-screenshot-mcp HTTP os command injection](https://agentprime.io/advisories/CVE-2026-5528.md)
  `CVE-2026-5528` · CVE record: MoussaabBadla code-screenshot-mcp · CVSS 5.3 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Command injection
- [pyLoad: Improper Neutralization of Special Elements used in an OS Command](https://agentprime.io/advisories/GHSA-w48f-wwwf-f5fr.md)
  `GHSA-w48f-wwwf-f5fr`, `CVE-2026-35463`, `PYSEC-2026-2267` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev96`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 4 Apr 2026 · Tags: Command injection
- [Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step](https://agentprime.io/advisories/GHSA-fcm4-4pj2-m5hf.md)
  `GHSA-fcm4-4pj2-m5hf`, `CVE-2026-35216` · npm `@budibase/server`: affected `<3.33.4`, fixed in `3.33.4` · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 4 Apr 2026 · Tags: Command injection
- [ProSoft Technology ICX35-HWC Command Injection via Web Interface](https://agentprime.io/advisories/CVE-2017-20236.md)
  `CVE-2017-20236` · CVE record: ProSoft Technology ICX35-HWC Cellular Gateway · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: Command injection
- [BentoML: Command Injection in cloud deployment setup script](https://agentprime.io/advisories/GHSA-fgv4-6jr3-jgfw.md)
  `GHSA-fgv4-6jr3-jgfw`, `CVE-2026-35043`, `PYSEC-2026-158` · PyPI `bentoml`: affected `<1.4.38`, fixed in `1.4.38` · CVSS 7.8 High · Not analysed yet · Published 3 Apr 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA0LTAzVDIyOjAzOjIyLjAwMDAwMFoiLCJHSFNBLWZndjQtNmpyMy1qZ2Z3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA0LTA5VDE0OjIyOjI5LjAwMDAwMFoiLCJHSFNBLTc0MzctN2hnOC1mcnJ3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA0LTA5VDE0OjIyOjI5LjAwMDAwMFoiLCJHSFNBLTc0MzctN2hnOC1mcnJ3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.