# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args](https://agentprime.io/advisories/GHSA-r253-r9jw-qg44.md)
  `GHSA-r253-r9jw-qg44`, `CVE-2026-57572`, `PYSEC-2026-2139` · PyPI `crawl4ai`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Code injection
- [PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml](https://agentprime.io/advisories/GHSA-7qw2-w5rc-37x2.md)
  `GHSA-7qw2-w5rc-37x2`, `CVE-2026-57142`, `PYSEC-2026-3505` · PyPI `praisonai`: affected `>=4.5.87, <4.6.61`, fixed in `4.6.61` · CVSS 7.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Code injection, Broken access control
- [npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining](https://agentprime.io/advisories/GHSA-5jv7-2mjm-h6qj.md)
  `GHSA-5jv7-2mjm-h6qj`, `CVE-2026-57133` · npm `praisonai`: affected `>=1.5.1, <1.7.2`, fixed in `1.7.2` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Broken access control, CWE-693
- [npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining](https://agentprime.io/advisories/GHSA-vjv9-7m7j-h833.md)
  `GHSA-vjv9-7m7j-h833`, `CVE-2026-57136` · npm `praisonai`: affected `>=1.2.3, <1.7.2`, fixed in `1.7.2` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Broken access control, CWE-693
- [PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters](https://agentprime.io/advisories/GHSA-c969-5x3p-vq3v.md)
  `GHSA-c969-5x3p-vq3v`, `CVE-2026-57130`, `PYSEC-2026-3532` · PyPI `praisonaiagents`: affected `<1.6.59`, fixed in `1.6.59` · CVSS 8.1 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, CWE-20
- [PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai](https://agentprime.io/advisories/GHSA-p75f-6fp4-p57w.md)
  `GHSA-p75f-6fp4-p57w`, `CVE-2026-57124`, `PYSEC-2026-3517` · PyPI `praisonai`: affected `<4.6.59`, fixed in `4.6.59` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Authentication bypass
- [PraisonAI: Compute-bridged file tools allow shell command injection](https://agentprime.io/advisories/GHSA-w6h2-fr4q-xvxv.md)
  `GHSA-w6h2-fr4q-xvxv`, `CVE-2026-57117`, `PYSEC-2026-3522` · PyPI `praisonai`: affected `>=4.6.10, <4.6.59`, fixed in `4.6.59` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Broken access control
- [PraisonAI recipe.run_stream skips dangerous-tool policy enforcement](https://agentprime.io/advisories/GHSA-v847-hxxw-3pxg.md)
  `GHSA-v847-hxxw-3pxg`, `CVE-2026-56838`, `PYSEC-2026-3520` · PyPI `praisonai`: affected `>=4.5.87, <4.6.59`, fixed in `4.6.59` · CVSS 7.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Broken access control, CWE-693
- [Docker MCP Gateway: Argument injection via OCI image label YAML](https://agentprime.io/advisories/GHSA-r2xf-7jw5-pjg6.md)
  `GHSA-r2xf-7jw5-pjg6`, `CVE-2026-55887`, `GO-2026-5604` · Go `github.com/docker/mcp-gateway`: affected `>=0.21.0, <0.42.2`, fixed in `0.42.2` · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection
- [OS Command Injection in LMS](https://agentprime.io/advisories/CVE-2026-40456.md)
  `CVE-2026-40456` · CVE record: LMS LMS · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection
- [InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function.](https://agentprime.io/advisories/CVE-2026-38717.md)
  `CVE-2026-38717` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection
- [InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function.](https://agentprime.io/advisories/CVE-2026-38716.md)
  `CVE-2026-38716` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection
- [InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function.](https://agentprime.io/advisories/CVE-2026-38715.md)
  `CVE-2026-38715` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection
- [InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python configuration function.](https://agentprime.io/advisories/CVE-2026-38714.md)
  `CVE-2026-38714` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection
- [e107: Command Injection via shell expansion in ImageMagick resize destination path](https://agentprime.io/advisories/CVE-2026-48997.md)
  `CVE-2026-48997` · CVE record: e107inc e107 · CVSS 7.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Command injection
- [OpenStack Horizon RC file generation does not escape special characters in project names](https://agentprime.io/advisories/GHSA-6wrm-x65g-hr4p.md)
  `GHSA-6wrm-x65g-hr4p`, `CVE-2026-55748`, `PYSEC-2026-2519` · PyPI `horizon`: affected `<=25.7.3`, no fixed version yet · CVSS 6.0 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Command injection
- [OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit](https://agentprime.io/advisories/CVE-2026-20266.md)
  `CVE-2026-20266` · CVE record: Splunk Splunk AI Toolkit · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Command injection
- [OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution](https://agentprime.io/advisories/CVE-2026-55743.md)
  `CVE-2026-55743` · CVE record: tinyhumansai OpenHuman · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Command injection, CWE-184
- [OS command injection in Micro-Star International Co., Ltd. RadiX AX6600 WiFi 6 Tri-Band Gaming Router](https://agentprime.io/advisories/CVE-2026-53876.md)
  `CVE-2026-53876` · CVE record: Micro-Star International Co., Ltd. RadiX AX6600 WiFi 6 Tri-Band Gaming Router · CVSS 8.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: Command injection
- [Rclone: Unauthenticated command execution in \`rclone rcd --rc-serve\` via inline remote instantiation, bypassing CVE-2026-41179 fix](https://agentprime.io/advisories/GHSA-qw24-gh76-8rvv.md)
  `GHSA-qw24-gh76-8rvv`, `BIT-rclone-2026-49980`, `CVE-2026-49980`, `GO-2026-5596` · Go `github.com/rclone/rclone`: affected `>=1.46.0, <1.74.3`, fixed in `1.74.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection, Authentication bypass
- [yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp](https://agentprime.io/advisories/GHSA-69qj-pvh9-c5wg.md)
  `GHSA-69qj-pvh9-c5wg` · PyPI `yt-dlp`: affected `>=2021.4.11, <2026.6.9`, fixed in `2026.6.9` · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N](https://agentprime.io/advisories/CVE-2026-11409.md)
  `CVE-2026-11409` · CVE record: TP-Link Systems Inc. TL-WR940N v6 · CVSS 8.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N](https://agentprime.io/advisories/CVE-2026-11410.md)
  `CVE-2026-11410` · CVE record: TP-Link Systems Inc. TL-WR940N v6 · CVSS 8.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [Deno: Command Injection via spawnSync & spawn on Windows](https://agentprime.io/advisories/GHSA-7xh3-mhg9-jcw8.md)
  `GHSA-7xh3-mhg9-jcw8`, `CVE-2026-49402` · crates.io `deno`: affected `<2.7.10`, fixed in `2.7.10` · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector](https://agentprime.io/advisories/CVE-2026-22313.md)
  `CVE-2026-22313` · CVE record: Radiflow iSAP Smart Collector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [Galaxy NG: command injection vulnerability](https://agentprime.io/advisories/GHSA-6hw7-j4jw-wpff.md)
  `GHSA-6hw7-j4jw-wpff`, `CVE-2026-12398`, `PYSEC-2026-2486` · PyPI `galaxy-ng`: affected `<=4.9.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [indirect remote shell command injection via unsanitized DHCP options in wicked](https://agentprime.io/advisories/CVE-2026-44932.md)
  `CVE-2026-44932` · CVE record: SUSE wicked · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [Command injection in Dell OpenManage](https://agentprime.io/advisories/CVE-2024-24909.md)
  `CVE-2024-24909` · CVE record: Dell OpenManage · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [Command Injection via name parameter](https://agentprime.io/advisories/CVE-2026-5416.md)
  `CVE-2026-5416` · CVE record: TURCK TBEN-LL-SE-M2 and 2 more · CVSS 8.7 High · Not analysed yet · Published 16 Jun 2026 · Tags: Command injection
- [OS command injection in Devolutions Remote Desktop Manager](https://agentprime.io/advisories/CVE-2026-12161.md)
  `CVE-2026-12161` · CVE record: Devolutions Remote Desktop Manager · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json](https://agentprime.io/advisories/CVE-2026-48723.md)
  `CVE-2026-48723` · CVE record: browserstack browserstack-cypress-cli · CVSS 7.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [aws-cdk-lib: OS Command Injection in NodejsFunction Bundling](https://agentprime.io/advisories/GHSA-999r-qq7v-r334.md)
  `GHSA-999r-qq7v-r334`, `CVE-2026-11417` · npm `aws-cdk-lib`: affected `<2.246.0`, fixed in `2.246.0` · CVSS 7.0 High · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability](https://agentprime.io/advisories/CVE-2026-9863.md)
  `CVE-2026-9863` · CVE record: Fortra Core Privileged Access Manager (BoKS) · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability](https://agentprime.io/advisories/CVE-2026-9862.md)
  `CVE-2026-9862` · CVE record: Fortra Core Privileged Access Manager (BoKS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection](https://agentprime.io/advisories/CVE-2026-12223.md)
  `CVE-2026-12223` · CVE record: Yealink SIP-T46U · CVSS 5.1 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection, Command injection
- [Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection](https://agentprime.io/advisories/CVE-2026-12219.md)
  `CVE-2026-12219` · CVE record: Yealink SIP-T46U · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Other injection, Command injection
- [An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.](https://agentprime.io/advisories/CVE-2026-50874.md)
  `CVE-2026-50874` · CVE record · CVSS 8.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.](https://agentprime.io/advisories/CVE-2026-38065.md)
  `CVE-2026-38065` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.](https://agentprime.io/advisories/CVE-2026-38064.md)
  `CVE-2026-38064` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.](https://agentprime.io/advisories/CVE-2026-38063.md)
  `CVE-2026-38063` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.](https://agentprime.io/advisories/CVE-2026-38062.md)
  `CVE-2026-38062` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.](https://agentprime.io/advisories/CVE-2026-38061.md)
  `CVE-2026-38061` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.](https://agentprime.io/advisories/CVE-2026-38060.md)
  `CVE-2026-38060` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.](https://agentprime.io/advisories/CVE-2025-56814.md)
  `CVE-2025-56814` · CVE record · CVSS 7.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Command injection
- [Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection](https://agentprime.io/advisories/CVE-2026-12197.md)
  `CVE-2026-12197` · CVE record: Ruijie EG105G-P · CVSS 8.6 High · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, Command injection
- [GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection](https://agentprime.io/advisories/CVE-2026-12187.md)
  `CVE-2026-12187` · CVE record: GL.iNet GL-MT3000 · CVSS 8.7 High · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, Command injection
- [GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection](https://agentprime.io/advisories/CVE-2026-12186.md)
  `CVE-2026-12186` · CVE record: GL.iNet GL-MT3000 · CVSS 8.7 High · Not analysed yet · Published 14 Jun 2026 · Tags: Other injection, Command injection
- [Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in \_make_filehandle](https://agentprime.io/advisories/CVE-2026-11527.md)
  `CVE-2026-11527` · CVE record: SHLOMIF Config::IniFiles · CVSS 8.6 High · Not analysed yet · Published 14 Jun 2026 · Tags: Path traversal, Command injection
- [GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in \_make_filehandle](https://agentprime.io/advisories/CVE-2026-11526.md)
  `CVE-2026-11526` · CVE record: RURBAN GD · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jun 2026 · Tags: Path traversal, Command injection
- [File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection](https://agentprime.io/advisories/GHSA-8c9q-7855-wfxq.md)
  `GHSA-8c9q-7855-wfxq`, `CVE-2026-54090`, `GO-2026-5250` · Go `github.com/filebrowser/filebrowser/v2`: affected `<2.33.8`, fixed in `2.33.8` · CVSS 8.7 High · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection, CWE-184
- [Kitty has a shell command injection](https://agentprime.io/advisories/CVE-2026-42850.md)
  `CVE-2026-42850` · CVE record: kovidgoyal kitty · CVSS 7.4 High · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [MariaDB: unsafe usage of \`wsrep_sst_receive_address\` values on the joiner side](https://agentprime.io/advisories/CVE-2026-48165.md)
  `CVE-2026-48165` · CVE record: MariaDB server · CVSS 8.0 High · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)](https://agentprime.io/advisories/CVE-2026-48163.md)
  `CVE-2026-48163` · CVE record: MariaDB server · CVSS 8.0 High · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [MariaDB: wsrep SST unsafe parameter handling on the donor side](https://agentprime.io/advisories/CVE-2026-44168.md)
  `CVE-2026-44168` · CVE record: MariaDB server · CVSS 8.0 High · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL](https://agentprime.io/advisories/CVE-2026-44170.md)
  `CVE-2026-44170` · CVE record: MariaDB server · CVSS 6.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection](https://agentprime.io/advisories/CVE-2026-11845.md)
  `CVE-2026-11845` · CVE record: IEI Integration Corp iVEC TANK-XM811 · CVSS 8.6 High · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [Argument injection in WebPros WordPress-Toolkit](https://agentprime.io/advisories/CVE-2026-47365.md)
  `CVE-2026-47365` · CVE record: WebPros WordPress-Toolkit · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Command injection
- [ClipBucket: Remote Play URL Command Injection](https://agentprime.io/advisories/CVE-2026-42846.md)
  `CVE-2026-42846` · CVE record: MacWarrior clipbucket-v5 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: Command injection
- [Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command](https://agentprime.io/advisories/CVE-2026-45172.md)
  `CVE-2026-45172` · CVE record: CyberArk Software, a Palo Alto Networks Company PAM Self-Hosted, Privilege Cloud · CVSS 8.7 High · Not analysed yet · Published 11 Jun 2026 · Tags: Command injection
- [KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml](https://agentprime.io/advisories/CVE-2026-48547.md)
  `CVE-2026-48547` · CVE record: lingdojo kana-dojo · CVSS 8.5 High · Not analysed yet · Published 11 Jun 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA2LTExVDE4OjMzOjE0Ljk4MDAwMFoiLCJDVkUtMjAyNi00ODU0NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA2LTE4VDIwOjEwOjMwLjAwMDAwMFoiLCJHSFNBLWN3cHAtNTk2Mi1xNGY2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA2LTE4VDIwOjEwOjMwLjAwMDAwMFoiLCJHSFNBLWN3cHAtNTk2Mi1xNGY2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.