# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [TRENDnet TEW-821DAP tools_diagnostic os command injection](https://agentprime.io/advisories/CVE-2026-7608.md)
  `CVE-2026-7608` · CVE record: TRENDnet TEW-821DAP · CVSS 5.1 Medium · Not analysed yet · Published 2 May 2026 · Tags: Command injection
- [yii2-mcp-server has a Command Injection Issue](https://agentprime.io/advisories/GHSA-gc8w-x73w-p4rh.md)
  `GHSA-gc8w-x73w-p4rh`, `CVE-2026-7600` · npm `yii2-mcp-server`: affected `<=1.0.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: Command injection
- [Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection](https://agentprime.io/advisories/CVE-2026-7593.md)
  `CVE-2026-7593` · CVE record: Sunwood-ai-labs command-executor-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 1 May 2026 · Tags: Command injection
- [eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection](https://agentprime.io/advisories/CVE-2026-7590.md)
  `CVE-2026-7590` · CVE record: eyal-gor p_69_branch_monkey_mcp · CVSS 6.9 Medium · Not analysed yet · Published 1 May 2026 · Tags: Command injection
- [OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere](https://agentprime.io/advisories/GHSA-rmxr-45gj-889w.md)
  `GHSA-rmxr-45gj-889w`, `CVE-2026-43003`, `PYSEC-2026-205` · PyPI `ironic-python-agent`: affected `>=1.0.0, <11.6.0`, fixed in `11.6.0` · CVSS 8.0 High · Not analysed yet · Published 1 May 2026 · Tags: Command injection, CWE-829
- [OS command injection in Bitwarden CLI](https://agentprime.io/advisories/CVE-2026-42994.md)
  `CVE-2026-42994` · CVE record: Bitwarden Bitwarden CLI · CVSS 8.8 High · Not analysed yet · Published 1 May 2026 · Tags: Command injection
- [Totolink NR1800X cstecgi.cgi sub_41A68C command injection](https://agentprime.io/advisories/CVE-2026-7548.md)
  `CVE-2026-7548` · CVE record: Totolink NR1800X · CVSS 8.7 High · Not analysed yet · Published 1 May 2026 · Tags: Other injection, Command injection
- [Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection](https://agentprime.io/advisories/CVE-2026-7538.md)
  `CVE-2026-7538` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 May 2026 · Tags: Command injection
- [A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.](https://agentprime.io/advisories/CVE-2026-26461.md)
  `CVE-2026-26461` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 May 2026 · Tags: Command injection
- [HKUDS OpenHarness Remote Command Execution via /bridge Slash Command](https://agentprime.io/advisories/CVE-2026-7551.md)
  `CVE-2026-7551` · CVE record: HKUDS OpenHarness · CVSS 8.7 High · Not analysed yet · Published 30 Apr 2026 · Tags: Command injection
- [Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)](https://agentprime.io/advisories/GHSA-q7r4-hc83-hf2q.md)
  `GHSA-q7r4-hc83-hf2q`, `CVE-2026-40281`, `GO-2026-5572` · Go `github.com/gotenberg/gotenberg/v8`: affected `<8.31.0`, fixed in `8.31.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Apr 2026 · Tags: Command injection
- [Synway SMG Gateway Management Software OS Command Injection via radius_address](https://agentprime.io/advisories/CVE-2025-71284.md)
  `CVE-2025-71284` · CVE record: Synway Information Engineering Co., Ltd. Synway SMG Gateway Management Software · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Apr 2026 · Tags: Command injection
- [Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.](https://agentprime.io/advisories/GHSA-47fr-3ffg-hgmw.md)
  `GHSA-47fr-3ffg-hgmw`, `CVE-2026-7246`, `PYSEC-2026-2132` · PyPI `click`: affected `<8.3.3`, fixed in `8.3.3` · CVSS 7.2 High · Withdrawn · Not analysed yet · Published 30 Apr 2026 · Tags: Command injection
- [Tenda 4G300 DelFil sub_425A28 command injection](https://agentprime.io/advisories/CVE-2026-7469.md)
  `CVE-2026-7469` · CVE record: Tenda 4G300 · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Other injection, Command injection
- [mcp-server-semgrep has a Command Injection issue](https://agentprime.io/advisories/GHSA-86hp-qxqp-w9wv.md)
  `GHSA-86hp-qxqp-w9wv`, `CVE-2026-7446` · npm `mcp-server-semgrep`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Command injection
- [BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection](https://agentprime.io/advisories/CVE-2026-7443.md)
  `CVE-2026-7443` · CVE record: BurtTheCoder mcp-dnstwist · CVSS 6.9 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Command injection
- [PolarVista xcode-mcp-server MCP index.ts run_tests os command injection](https://agentprime.io/advisories/CVE-2026-7416.md)
  `CVE-2026-7416` · CVE record: PolarVista xcode-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Command injection
- [Unauthenticated RCE in DocsGPT MCP STDIO Configuration](https://agentprime.io/advisories/CVE-2026-26015.md)
  `CVE-2026-26015` · CVE record: arc53 DocsGPT · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Command injection
- [OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer](https://agentprime.io/advisories/CVE-2026-6849.md)
  `CVE-2026-6849` · CVE record: TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer · CVSS 8.8 High · Not analysed yet · Published 29 Apr 2026 · Tags: Command injection
- [TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.](https://agentprime.io/advisories/CVE-2026-36841.md)
  `CVE-2026-36841` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Command injection
- [eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection](https://agentprime.io/advisories/CVE-2026-7316.md)
  `CVE-2026-7316` · CVE record: eiliyaabedini aider-mcp · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, Command injection
- [Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection](https://agentprime.io/advisories/CVE-2026-7244.md)
  `CVE-2026-7244` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection](https://agentprime.io/advisories/CVE-2026-7243.md)
  `CVE-2026-7243` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection](https://agentprime.io/advisories/CVE-2026-7242.md)
  `CVE-2026-7242` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection](https://agentprime.io/advisories/CVE-2026-7241.md)
  `CVE-2026-7241` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection](https://agentprime.io/advisories/CVE-2026-7240.md)
  `CVE-2026-7240` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Command Injection](https://agentprime.io/advisories/CVE-2024-54012.md)
  `CVE-2024-54012` · CVE record: Hanwha Vision QND-8080R · CVSS 8.5 High · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection](https://agentprime.io/advisories/CVE-2026-7220.md)
  `CVE-2026-7220` · CVE record: jackwrichards FastlyMCP · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [OS command injection in Zyxel DX3301-T0 firmware and others](https://agentprime.io/advisories/CVE-2026-1460.md)
  `CVE-2026-1460` · CVE record: Zyxel DX3301-T0 firmware and 1 more · CVSS 7.2 High · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection](https://agentprime.io/advisories/CVE-2026-7215.md)
  `CVE-2026-7215` · CVE record: egtai gmx-vmd-mcp · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, Command injection
- [OS command injection in Zyxel DX3300-T0 firmware](https://agentprime.io/advisories/CVE-2026-0711.md)
  `CVE-2026-0711` · CVE record: Zyxel DX3300-T0 firmware · CVSS 6.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection](https://agentprime.io/advisories/CVE-2026-7211.md)
  `CVE-2026-7211` · CVE record: dvladimirov MCP · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Other injection, Command injection
- [Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection](https://agentprime.io/advisories/CVE-2026-7204.md)
  `CVE-2026-7204` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection](https://agentprime.io/advisories/CVE-2026-7203.md)
  `CVE-2026-7203` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection](https://agentprime.io/advisories/CVE-2026-7202.md)
  `CVE-2026-7202` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Milesight Cameras OS Command Injection](https://agentprime.io/advisories/CVE-2026-32649.md)
  `CVE-2026-32649` · CVE record: Milesight MS-Cxx63-PD and 4 more · CVSS 7.3 High · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Tenda HG3 formTracert command injection](https://agentprime.io/advisories/CVE-2026-7160.md)
  `CVE-2026-7160` · CVE record: Tenda HG3 · CVSS 8.7 High · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, Command injection
- [disler aider-mcp-server aider_ai_code server.py command injection](https://agentprime.io/advisories/CVE-2026-7157.md)
  `CVE-2026-7157` · CVE record: disler aider-mcp-server · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, Command injection
- [Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection](https://agentprime.io/advisories/CVE-2026-7156.md)
  `CVE-2026-7156` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection](https://agentprime.io/advisories/CVE-2026-7155.md)
  `CVE-2026-7155` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection](https://agentprime.io/advisories/CVE-2026-7154.md)
  `CVE-2026-7154` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection](https://agentprime.io/advisories/CVE-2026-7153.md)
  `CVE-2026-7153` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection](https://agentprime.io/advisories/CVE-2026-7152.md)
  `CVE-2026-7152` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection](https://agentprime.io/advisories/CVE-2026-7140.md)
  `CVE-2026-7140` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection](https://agentprime.io/advisories/CVE-2026-7139.md)
  `CVE-2026-7139` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection](https://agentprime.io/advisories/CVE-2026-7138.md)
  `CVE-2026-7138` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection](https://agentprime.io/advisories/CVE-2026-7137.md)
  `CVE-2026-7137` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection](https://agentprime.io/advisories/CVE-2026-7136.md)
  `CVE-2026-7136` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection](https://agentprime.io/advisories/CVE-2026-7125.md)
  `CVE-2026-7125` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection](https://agentprime.io/advisories/CVE-2026-7124.md)
  `CVE-2026-7124` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection](https://agentprime.io/advisories/CVE-2026-7123.md)
  `CVE-2026-7123` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection](https://agentprime.io/advisories/CVE-2026-7122.md)
  `CVE-2026-7122` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection](https://agentprime.io/advisories/CVE-2026-7121.md)
  `CVE-2026-7121` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Tenda HG3 formCountrystr os command injection](https://agentprime.io/advisories/CVE-2026-7119.md)
  `CVE-2026-7119` · CVE record: Tenda HG3 · CVSS 8.7 High · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [Tenda F456 httpd WriteFacMac FromWriteFacMac command injection](https://agentprime.io/advisories/CVE-2026-7102.md)
  `CVE-2026-7102` · CVE record: Tenda F456 · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, Command injection
- [Tenda HG3 formgponConf os command injection](https://agentprime.io/advisories/CVE-2026-7096.md)
  `CVE-2026-7096` · CVE record: Tenda HG3 · CVSS 8.7 High · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [OS command injection in Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)…](https://agentprime.io/advisories/CVE-2026-33277.md)
  `CVE-2026-33277` · CVE record: Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) LogonTracer · CVSS 8.7 High · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi.](https://agentprime.io/advisories/CVE-2026-31255.md)
  `CVE-2026-31255` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.](https://agentprime.io/advisories/CVE-2026-30352.md)
  `CVE-2026-30352` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Command injection
- [D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection](https://agentprime.io/advisories/CVE-2026-7067.md)
  `CVE-2026-7067` · CVE record: D-Link DIR-822 · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Other injection, Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA0LTI2VDIzOjMwOjE3Ljk4NzAwMFoiLCJDVkUtMjAyNi03MDY3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA1LTAyVDA5OjAwOjE4Ljg2MzAwMFoiLCJDVkUtMjAyNi03NjA5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA1LTAyVDA5OjAwOjE4Ljg2MzAwMFoiLCJDVkUtMjAyNi03NjA5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.