# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions](https://agentprime.io/advisories/CVE-2026-44463.md)
  `CVE-2026-44463` · CVE record: zed-industries zed · CVSS 8.6 High · Not analysed yet · Published 28 May 2026 · Tags: Command injection, CWE-184
- [Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config](https://agentprime.io/advisories/CVE-2026-44465.md)
  `CVE-2026-44465` · CVE record: zed-industries zed · CVSS 8.6 High · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)](https://agentprime.io/advisories/CVE-2026-44461.md)
  `CVE-2026-44461` · CVE record: zed-industries zed · CVSS 8.6 High · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [Samba: remote code execution in samr](https://agentprime.io/advisories/CVE-2026-4408.md)
  `CVE-2026-4408` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.47 · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command](https://agentprime.io/advisories/CVE-2026-44604.md)
  `CVE-2026-44604` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 7.0 High · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier ve…](https://agentprime.io/advisories/CVE-2026-38707.md)
  `CVE-2026-38707` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlie…](https://agentprime.io/advisories/CVE-2026-38704.md)
  `CVE-2026-38704` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier…](https://agentprime.io/advisories/CVE-2026-38703.md)
  `CVE-2026-38703` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier…](https://agentprime.io/advisories/CVE-2026-38702.md)
  `CVE-2026-38702` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Command injection
- [OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON](https://agentprime.io/advisories/CVE-2026-45322.md)
  `CVE-2026-45322` · CVE record: microsoft UFO · CVSS 7.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Tanium addressed an unauthorized code execution vulnerability in Connect.](https://agentprime.io/advisories/CVE-2026-9208.md)
  `CVE-2026-9208` · CVE record: Tanium Connect · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address](https://agentprime.io/advisories/GHSA-xx3c-qf5g-hc39.md)
  `GHSA-xx3c-qf5g-hc39`, `CVE-2026-45068`, `PKSA-28rh-rzzn-djk4`, `PKSA-9sj3-tcvg-s7g4` · Packagist `symfony/mailer` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent](https://agentprime.io/advisories/CVE-2026-44712.md)
  `CVE-2026-44712` · CVE record: mcdope pam_usb · CVSS 8.2 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution](https://agentprime.io/advisories/CVE-2026-44709.md)
  `CVE-2026-44709` · CVE record: mcdope pam_usb · CVSS 7.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [pam_usb: Command injection via $TMUX environment variable leads to RCE as root](https://agentprime.io/advisories/CVE-2026-44713.md)
  `CVE-2026-44713` · CVE record: mcdope pam_usb · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection, CWE-116
- [Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml](https://agentprime.io/advisories/CVE-2026-44590.md)
  `CVE-2026-44590` · CVE record: sherlock-project sherlock · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [picoclaw is vulnerable to OS command injection via the ExecTool component](https://agentprime.io/advisories/GHSA-cv2p-68f4-f4pw.md)
  `GHSA-cv2p-68f4-f4pw`, `CVE-2026-36045`, `GO-2026-5867` · Go `github.com/sipeed/picoclaw`: affected `<=0.1.2`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Command injection via malicious configuration](https://agentprime.io/advisories/CVE-2026-40852.md)
  `CVE-2026-40852` · CVE record: MB connect line mbNET/mbNET.rokey and 3 more · CVSS 7.2 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()](https://agentprime.io/advisories/CVE-2026-8450.md)
  `CVE-2026-8450` · CVE record: OALDERS HTTP::Daemon · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Path traversal, Command injection
- [Tanium addressed an unauthorized code execution vulnerability in Connect.](https://agentprime.io/advisories/CVE-2026-9207.md)
  `CVE-2026-9207` · CVE record: Tanium Connect · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path that matches the improperly terminated search criteria of…](https://agentprime.io/advisories/CVE-2026-38945.md)
  `CVE-2026-38945` · CVE record · CVSS 7.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint.](https://agentprime.io/advisories/CVE-2026-36540.md)
  `CVE-2026-36540` · CVE record · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool.](https://agentprime.io/advisories/CVE-2026-36044.md)
  `CVE-2026-36044` · CVE record · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getconfig, upload, inventory, and oracle options.](https://agentprime.io/advisories/CVE-2025-69600.md)
  `CVE-2025-69600` · CVE record · CVSS 7.8 High · Not analysed yet · Published 27 May 2026 · Tags: Command injection
- [Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations](https://agentprime.io/advisories/GHSA-rr59-xxvx-96qr.md)
  `GHSA-rr59-xxvx-96qr`, `CVE-2026-44210`, `GO-2026-5638` · Go `github.com/kata-containers/kata-containers`: affected `<0.0.0-20260519062212-ffa59ce3aa78`, fixed in `0.0.0-20260519062212-ffa59ce3aa78` · CVSS 5.8 Medium · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan](https://agentprime.io/advisories/CVE-2026-44444.md)
  `CVE-2026-44444` · CVE record: prolix-oc Lumiverse · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Lumiverse: SMB \`exists()\` basename injection via smbclient \`!cmd\` escape](https://agentprime.io/advisories/CVE-2026-44449.md)
  `CVE-2026-44449` · CVE record: prolix-oc Lumiverse · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Lumiverse: RCE via MCP stdio argument injection](https://agentprime.io/advisories/CVE-2026-44450.md)
  `CVE-2026-44450` · CVE record: prolix-oc Lumiverse · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [OS command injection in OpenVPN Inc OpenVPN Connect](https://agentprime.io/advisories/CVE-2026-9560.md)
  `CVE-2026-9560` · CVE record: OpenVPN Inc OpenVPN Connect · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection, Privilege escalation, CWE-648
- [Twenty: SQL Injection via the timeZone field](https://agentprime.io/advisories/CVE-2026-46624.md)
  `CVE-2026-46624` · CVE record: twentyhq twenty · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection, SQL injection
- [haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection](https://agentprime.io/advisories/CVE-2026-9565.md)
  `CVE-2026-9565` · CVE record: haojing8312 WorkClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner](https://agentprime.io/advisories/CVE-2026-44723.md)
  `CVE-2026-44723` · CVE record: VowpalWabbit vowpal_wabbit · CVSS 5.0 Medium · Not analysed yet · Published 26 May 2026 · Tags: Command injection, Code injection
- [Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules](https://agentprime.io/advisories/GHSA-m4f9-c775-wg56.md)
  `GHSA-m4f9-c775-wg56` · crates.io `gix`: affected `>=0.31.0, <0.83.0`, fixed in `0.83.0` · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [luci-app-https-dns-proxy Authenticated Command Injection via setInitAction](https://agentprime.io/advisories/CVE-2026-46368.md)
  `CVE-2026-46368` · CVE record: mossdef-org luci-app-https-dns-proxy · CVSS 8.7 High · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Samba: samba: remote code execution in printing subsystem via unescaped job description](https://agentprime.io/advisories/CVE-2026-4480.md)
  `CVE-2026-4480` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Prefect has an Argument Injection issue](https://agentprime.io/advisories/GHSA-cw25-2p92-7f75.md)
  `GHSA-cw25-2p92-7f75`, `CVE-2026-3515`, `PYSEC-2026-2957` · PyPI `prefect`: affected `<=3.6.18`, no fixed version yet · CVSS 8.5 High · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection](https://agentprime.io/advisories/CVE-2026-9543.md)
  `CVE-2026-9543` · CVE record: Totolink N300RH · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection](https://agentprime.io/advisories/CVE-2026-9534.md)
  `CVE-2026-9534` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · EPSS 0.10 · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection](https://agentprime.io/advisories/CVE-2026-9533.md)
  `CVE-2026-9533` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · EPSS 0.10 · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection](https://agentprime.io/advisories/CVE-2026-9532.md)
  `CVE-2026-9532` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · EPSS 0.10 · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection](https://agentprime.io/advisories/CVE-2026-9531.md)
  `CVE-2026-9531` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · EPSS 0.10 · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin.](https://agentprime.io/advisories/CVE-2026-48695.md)
  `CVE-2026-48695` · CVE record · CVSS 8.1 High · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin.](https://agentprime.io/advisories/CVE-2026-48694.md)
  `CVE-2026-48694` · CVE record · CVSS 8.1 High · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin.](https://agentprime.io/advisories/CVE-2026-48687.md)
  `CVE-2026-48687` · CVE record · CVSS 8.1 High · Not analysed yet · Published 26 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection](https://agentprime.io/advisories/CVE-2026-9515.md)
  `CVE-2026-9515` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · EPSS 0.10 · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection](https://agentprime.io/advisories/CVE-2026-9514.md)
  `CVE-2026-9514` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · EPSS 0.10 · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection](https://agentprime.io/advisories/CVE-2026-9513.md)
  `CVE-2026-9513` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection](https://agentprime.io/advisories/CVE-2026-9512.md)
  `CVE-2026-9512` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection](https://agentprime.io/advisories/CVE-2026-9511.md)
  `CVE-2026-9511` · CVE record: Totolink CA750-PoE · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection](https://agentprime.io/advisories/CVE-2026-9478.md)
  `CVE-2026-9478` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection](https://agentprime.io/advisories/CVE-2026-9477.md)
  `CVE-2026-9477` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection](https://agentprime.io/advisories/CVE-2026-9476.md)
  `CVE-2026-9476` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection](https://agentprime.io/advisories/CVE-2026-9475.md)
  `CVE-2026-9475` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection](https://agentprime.io/advisories/CVE-2026-9458.md)
  `CVE-2026-9458` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection](https://agentprime.io/advisories/CVE-2026-9457.md)
  `CVE-2026-9457` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection](https://agentprime.io/advisories/CVE-2026-9456.md)
  `CVE-2026-9456` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection](https://agentprime.io/advisories/CVE-2026-9455.md)
  `CVE-2026-9455` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection](https://agentprime.io/advisories/CVE-2026-9454.md)
  `CVE-2026-9454` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection
- [FoundDream miniclawd SkillsLoader skills-loader.ts which command injection](https://agentprime.io/advisories/CVE-2026-9453.md)
  `CVE-2026-9453` · CVE record: FoundDream miniclawd · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection
- [FoundDream miniclawd exec.ts ExecTool.execute os command injection](https://agentprime.io/advisories/CVE-2026-9452.md)
  `CVE-2026-9452` · CVE record: FoundDream miniclawd · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA1LTI1VDExOjAwOjE3LjIxOTAwMFoiLCJDVkUtMjAyNi05NDUyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA1LTI4VDE2OjE2OjA1LjQwOTAwMFoiLCJDVkUtMjAyNi00NDQ2NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA1LTI4VDE2OjE2OjA1LjQwOTAwMFoiLCJDVkUtMjAyNi00NDQ2NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.