# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [choieastsea simple-openstack-mcp server.py exec_openstack os command injection](https://agentprime.io/advisories/CVE-2026-7066.md)
  `CVE-2026-7066` · CVE record: choieastsea simple-openstack-mcp · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Command injection
- [AgentDeskAI browser-tools-mcp browser-connector.ts os command injection](https://agentprime.io/advisories/CVE-2026-7064.md)
  `CVE-2026-7064` · CVE record: AgentDeskAI browser-tools-mcp · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Command injection
- [Intina47 context-sync Git Integration git-integration.ts os command injection](https://agentprime.io/advisories/CVE-2026-7062.md)
  `CVE-2026-7062` · CVE record: Intina47 context-sync · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Command injection
- [Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection](https://agentprime.io/advisories/CVE-2026-7061.md)
  `CVE-2026-7061` · CVE record: Toowiredd chatgpt-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Command injection
- [666ghj MiroFish Inter-Process Communication simulation_ipc.py SimulationIPCClient.send_command command injection](https://agentprime.io/advisories/CVE-2026-7058.md)
  `CVE-2026-7058` · CVE record: 666ghj MiroFish · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, Command injection
- [tufantunc ssh-mcp index.ts shell.write command injection](https://agentprime.io/advisories/CVE-2026-7039.md)
  `CVE-2026-7039` · CVE record: tufantunc ssh-mcp · CVSS 8.5 High · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, Command injection
- [Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection](https://agentprime.io/advisories/CVE-2026-7037.md)
  `CVE-2026-7037` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Apr 2026 · Tags: Command injection
- [GitPython has Command Injection via Git options bypass](https://agentprime.io/advisories/GHSA-rpm5-65cw-6hj4.md)
  `GHSA-rpm5-65cw-6hj4`, `CVE-2026-42215`, `PYSEC-2026-2160` · PyPI `gitpython`: affected `>=3.1.30, <3.1.47`, fixed in `3.1.47` · CVSS 8.8 High · Not analysed yet · Published 25 Apr 2026 · Tags: Command injection
- [GitPython: Unsafe option check validates multi_options before shlex.split transformation](https://agentprime.io/advisories/GHSA-x2qx-6953-8485.md)
  `GHSA-x2qx-6953-8485`, `CVE-2026-42284`, `PYSEC-2026-2161` · PyPI `gitpython`: affected `<3.1.47`, fixed in `3.1.47` · CVSS 8.1 High · Not analysed yet · Published 25 Apr 2026 · Tags: Command injection
- [LiteLLM: Authenticated command execution via MCP stdio test endpoints](https://agentprime.io/advisories/GHSA-v4p8-mg3p-g94g.md)
  `GHSA-v4p8-mg3p-g94g`, `CVE-2026-42271`, `PYSEC-2026-2599` · PyPI `litellm`: affected `>=1.74.2, <1.83.7`, fixed in `1.83.7` · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.91 · Not analysed yet · Published 25 Apr 2026 · Tags: Command injection
- [PicoClaw has an Injection issue in its Web Launcher Management Plane component](https://agentprime.io/advisories/GHSA-6r3x-h84w-fhxx.md)
  `GHSA-6r3x-h84w-fhxx`, `CVE-2026-6987`, `GO-2026-5187` · Go `github.com/sipeed/picoclaw`: affected `<=0.2.4`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, Command injection
- [Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection](https://agentprime.io/advisories/CVE-2026-6992.md)
  `CVE-2026-6992` · CVE record: Linksys MR9600 · CVSS 8.6 High · Not analysed yet · Published 25 Apr 2026 · Tags: Command injection
- [Tenda F453 Telnet Service telnet TendaTelnet command injection](https://agentprime.io/advisories/CVE-2026-6989.md)
  `CVE-2026-6989` · CVE record: Tenda F453 · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, Command injection
- [Divyanshu-hash GitPilot-MCP main.py repo_path command injection](https://agentprime.io/advisories/CVE-2026-6980.md)
  `CVE-2026-6980` · CVE record: Divyanshu-hash GitPilot-MCP · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, Command injection
- [simple-git is vulnerable to Remote Code Execution](https://agentprime.io/advisories/GHSA-hffm-xvc3-vprc.md)
  `GHSA-hffm-xvc3-vprc`, `CVE-2026-6951` · npm `simple-git`: affected `<3.36.0`, fixed in `3.36.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Apr 2026 · Tags: Command injection, Code injection
- [electerm has Command Injection via runLinux funtion](https://agentprime.io/advisories/GHSA-8x35-hph8-37hq.md)
  `GHSA-8x35-hph8-37hq`, `CVE-2026-41501` · npm `electerm`: affected `<3.3.8`, fixed in `3.3.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Command injection
- [Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses](https://agentprime.io/advisories/GHSA-wpqr-6v78-jr5g.md)
  `GHSA-wpqr-6v78-jr5g`, `CVE-2026-12537` · npm `@google/gemini-cli`: affected `<0.39.1 || >=0.40.0-preview.2, <0.40.0-preview.3`, fixed in `0.39.1`, `0.40.0-preview.3` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Command injection, Information disclosure, CWE-20
- [SiYuan Desktop Notification XSS Leads to Electron RCE](https://agentprime.io/advisories/CVE-2026-41421.md)
  `CVE-2026-41421` · CVE record: siyuan-note siyuan · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Command injection, Cross-site scripting (XSS)
- [Vim: Command injection via backtick expansion in tag filenames](https://agentprime.io/advisories/CVE-2026-41411.md)
  `CVE-2026-41411` · CVE record: vim vim · CVSS 6.6 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Command injection
- [Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-q5hj-mxqh-vv77.md)
  `GHSA-q5hj-mxqh-vv77`, `CVE-2026-40068` · npm `@anthropic-ai/claude-code`: affected `>=2.1.63, <2.1.84`, fixed in `2.1.84` · CVSS 7.7 High · Not analysed yet · Published 24 Apr 2026 · Tags: Command injection, CWE-20
- [Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint](https://agentprime.io/advisories/CVE-2026-33208.md)
  `CVE-2026-33208` · CVE record: roxy-wi roxy-wi · CVSS 7.4 High · Not analysed yet · Published 24 Apr 2026 · Tags: Command injection
- [OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment](https://agentprime.io/advisories/GHSA-8h25-q488-4hxw.md)
  `GHSA-8h25-q488-4hxw`, `CVE-2026-41900` · npm `openlearnx`: affected `<2.0.3`, fixed in `2.0.3` · CVSS 8.8 High · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection, Code injection, Privilege escalation, Broken access control
- [radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass](https://agentprime.io/advisories/CVE-2026-6942.md)
  `CVE-2026-6942` · CVE record: radareorg radare2-mcp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31181.md)
  `CVE-2026-31181` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31179.md)
  `CVE-2026-31179` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31178.md)
  `CVE-2026-31178` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31177.md)
  `CVE-2026-31177` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31176.md)
  `CVE-2026-31176` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31175.md)
  `CVE-2026-31175` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31174.md)
  `CVE-2026-31174` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the interval parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31173.md)
  `CVE-2026-31173` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31172.md)
  `CVE-2026-31172` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31171.md)
  `CVE-2026-31171` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31169.md)
  `CVE-2026-31169` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31168.md)
  `CVE-2026-31168` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31167.md)
  `CVE-2026-31167` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31166.md)
  `CVE-2026-31166` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31165.md)
  `CVE-2026-31165` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31164.md)
  `CVE-2026-31164` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31163.md)
  `CVE-2026-31163` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31162.md)
  `CVE-2026-31162` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31160.md)
  `CVE-2026-31160` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.](https://agentprime.io/advisories/CVE-2026-31159.md)
  `CVE-2026-31159` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection
- [TSSC/IMC is vulnerable to OS Command Injection](https://agentprime.io/advisories/CVE-2026-5935.md)
  `CVE-2026-5935` · CVE record: IBM Total Storage Service Console (TSSC) / TS4500 IMC · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection
- [Evolver: Command Injection via \`execSync\` in \`\_extractLLM()\` function allows Remote Code Execution](https://agentprime.io/advisories/GHSA-j5w5-568x-rq53.md)
  `GHSA-j5w5-568x-rq53`, `CVE-2026-42076` · npm `@evomap/evolver`: affected `<1.69.3`, fixed in `1.69.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection
- [radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names](https://agentprime.io/advisories/CVE-2026-40517.md)
  `CVE-2026-40517` · CVE record: radareorg radare2 · CVSS 8.4 High · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection
- [Inspektor Gadget: Command Injection via malicious buildOptions manipulation](https://agentprime.io/advisories/GHSA-79qw-g77v-2vfh.md)
  `GHSA-79qw-g77v-2vfh`, `CVE-2026-24905`, `GO-2026-5211` · Go `github.com/inspektor-gadget/inspektor-gadget`: affected `<0.51.1`, fixed in `0.51.1` · CVSS 6.6 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection
- [PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes](https://agentprime.io/advisories/GHSA-mh6w-vxff-9wqp.md)
  `GHSA-mh6w-vxff-9wqp`, `PKSA-qccq-2pht-gg3w` · Packagist `phpunit/phpunit`: affected `>=12.5.21, <12.5.22 || >=13.1.5, <13.1.6`, fixed in `12.5.22`, `13.1.6` · CVSS 7.8 High · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection, Other injection
- [RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution](https://agentprime.io/advisories/GHSA-jfwf-28xr-xw6q.md)
  `GHSA-jfwf-28xr-xw6q`, `BIT-rclone-2026-41179`, `CVE-2026-41179`, `GO-2026-5466` · Go `github.com/rclone/rclone`: affected `>=1.48.0, <1.73.5`, fixed in `1.73.5` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection, Code injection, Authentication bypass
- [Comfast CF-N1-S Endpoint mbox-config command injection](https://agentprime.io/advisories/CVE-2026-6799.md)
  `CVE-2026-6799` · CVE record: Comfast CF-N1-S · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Other injection, Command injection
- [Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE](https://agentprime.io/advisories/GHSA-94jr-7pqp-xhcq.md)
  `GHSA-94jr-7pqp-xhcq`, `CVE-2026-40938`, `GO-2026-5272` · Go `github.com/tektoncd/pipeline`: affected `>=1.0.0, <1.0.2 || >=1.2.0, <1.3.4 || >=1.4.0, <1.6.2 || >=1.7.0, <1.9.3 || >=1.10.0, <1.11.1`, fixed in `1.0.2`, `1.3.4`, `1.6.2`, `1.9.3`, `1.11.1` · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [OS command injection in Atlassian Bamboo Data Center](https://agentprime.io/advisories/CVE-2026-21571.md)
  `CVE-2026-21571` · CVE record: Atlassian Bamboo Data Center · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions](https://agentprime.io/advisories/GHSA-j2g9-rprv-hrhc.md)
  `GHSA-j2g9-rprv-hrhc`, `CVE-2026-31019`, `PKSA-pnx2-khzh-yv6p` · Packagist `dolibarr/dolibarr`: affected `<=22.0.4`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [FreePBX api module Command Injection via GraphQL](https://agentprime.io/advisories/CVE-2026-40520.md)
  `CVE-2026-40520` · CVE record: FreePBX api · CVSS 8.6 High · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [Command Injection Vulnerability in Quantum Networks Router QN-I-470](https://agentprime.io/advisories/CVE-2026-41036.md)
  `CVE-2026-41036` · CVE record: Quantum Networks Router QN-I-470 · CVSS 8.7 High · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [NewSoft｜NewSoftOA - OS Command Injection](https://agentprime.io/advisories/CVE-2026-5965.md)
  `CVE-2026-5965` · CVE record: NewSoft NewSoftOA · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml](https://agentprime.io/advisories/CVE-2026-39866.md)
  `CVE-2026-39866` · CVE record: LawnchairLauncher lawnchair · CVSS 7.4 High · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter.](https://agentprime.io/advisories/CVE-2026-38835.md)
  `CVE-2026-38835` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter.](https://agentprime.io/advisories/CVE-2026-38834.md)
  `CVE-2026-38834` · CVE record · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2026 · Tags: Command injection
- [Command Injection and Docker container escape allows root on host machine](https://agentprime.io/advisories/CVE-2026-32311.md)
  `CVE-2026-32311` · CVE record: reconurge flowsint · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA0LTIwVDE5OjU2OjMyLjUyMTAwMFoiLCJDVkUtMjAyNi0zMjMxMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA0LTI2VDIzOjMwOjE3Ljk4NzAwMFoiLCJDVkUtMjAyNi03MDY3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA0LTI2VDIzOjMwOjE3Ljk4NzAwMFoiLCJDVkUtMjAyNi03MDY3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.