# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Dokploy: Command Injection via Unescaped Git URL in Clone Commands](https://agentprime.io/advisories/CVE-2026-72874.md)
  `CVE-2026-72874` · CVE record: Dokploy dokploy · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer](https://agentprime.io/advisories/CVE-2026-71966.md)
  `CVE-2026-71966` · CVE record: usmannasir cyberpanel · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: OS Command Injection via Bitbucket \`owner\`/\`repository\` in \`git clone\`](https://agentprime.io/advisories/CVE-2026-72872.md)
  `CVE-2026-72872` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command Injection via Docker Credentials in buildRemoteDocker](https://agentprime.io/advisories/CVE-2026-72870.md)
  `CVE-2026-72870` · CVE record: Dokploy dokploy · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE](https://agentprime.io/advisories/CVE-2026-72869.md)
  `CVE-2026-72869` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection](https://agentprime.io/advisories/CVE-2026-72868.md)
  `CVE-2026-72868` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, Broken access control
- [Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)](https://agentprime.io/advisories/CVE-2026-72867.md)
  `CVE-2026-72867` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, CWE-20, CWE-602
- [Dokploy: OS Command Injection via compose \`composePath\`](https://agentprime.io/advisories/CVE-2026-72865.md)
  `CVE-2026-72865` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE](https://agentprime.io/advisories/CVE-2026-72862.md)
  `CVE-2026-72862` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: OS Command Injection via SSH-form \`customGitUrl\` domain in \`ssh-keyscan\`](https://agentprime.io/advisories/CVE-2026-72740.md)
  `CVE-2026-72740` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command Injection via Compose Shell Execution](https://agentprime.io/advisories/CVE-2026-72739.md)
  `CVE-2026-72739` · CVE record: Dokploy dokploy · CVSS 6.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter](https://agentprime.io/advisories/CVE-2026-72738.md)
  `CVE-2026-72738` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE](https://agentprime.io/advisories/CVE-2026-72736.md)
  `CVE-2026-72736` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution](https://agentprime.io/advisories/CVE-2026-72735.md)
  `CVE-2026-72735` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: OS Command Injection via \`databaseName\` / \`backupFile\` in database restore](https://agentprime.io/advisories/CVE-2026-72733.md)
  `CVE-2026-72733` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Apache Ranger has a Command Injection vulnerability](https://agentprime.io/advisories/GHSA-6qc3-v8fv-fv9j.md)
  `GHSA-6qc3-v8fv-fv9j`, `CVE-2026-28672` · Maven `org.apache.ranger:ranger`: affected `>=0.6.0, <=2.8.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command Injection](https://agentprime.io/advisories/CVE-2026-13206.md)
  `CVE-2026-13206` · CVE record: Zyxel Networks WAH7601 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field](https://agentprime.io/advisories/CVE-2026-72589.md)
  `CVE-2026-72589` · CVE record: alseambusher crontab-ui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints](https://agentprime.io/advisories/CVE-2026-72580.md)
  `CVE-2026-72580` · CVE record: duhow xiaoai-patch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server](https://agentprime.io/advisories/CVE-2026-72579.md)
  `CVE-2026-72579` · CVE record: NASA HyperCP · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter](https://agentprime.io/advisories/CVE-2026-72573.md)
  `CVE-2026-72573` · CVE record: 4xmen pm2panel · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection](https://agentprime.io/advisories/CVE-2026-19379.md)
  `CVE-2026-19379` · CVE record: EFM ipTIME AX8004M · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection](https://agentprime.io/advisories/CVE-2026-19348.md)
  `CVE-2026-19348` · CVE record: Shenzhen Aitemi M300 Wi-Fi Repeater · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection
- [Tenda CH22 CertListInfo formCertListInfo command injection](https://agentprime.io/advisories/CVE-2026-19346.md)
  `CVE-2026-19346` · CVE record: Tenda CH22 · CVSS 8.7 High · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection
- [NightTrek Ollama-mcp index.ts command injection](https://agentprime.io/advisories/CVE-2026-19334.md)
  `CVE-2026-19334` · CVE record: NightTrek Ollama-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection
- [NightTrek Supabase-MCP generate_types command injection](https://agentprime.io/advisories/CVE-2026-19333.md)
  `CVE-2026-19333` · CVE record: NightTrek Supabase-MCP · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection
- [NellyW8 MCP4EDA run_openlane/view_waveform command injection](https://agentprime.io/advisories/CVE-2026-19332.md)
  `CVE-2026-19332` · CVE record: NellyW8 MCP4EDA · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection
- [andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection](https://agentprime.io/advisories/CVE-2026-19329.md)
  `CVE-2026-19329` · CVE record: andreahaku codex_mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection
- [MSI Radix AXE6600 v781521 Command Injection via openvpn function](https://agentprime.io/advisories/CVE-2026-71993.md)
  `CVE-2026-71993` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via macfilter](https://agentprime.io/advisories/CVE-2026-71992.md)
  `CVE-2026-71992` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function](https://agentprime.io/advisories/CVE-2026-71991.md)
  `CVE-2026-71991` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function](https://agentprime.io/advisories/CVE-2026-71990.md)
  `CVE-2026-71990` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via porTrigger function](https://agentprime.io/advisories/CVE-2026-71989.md)
  `CVE-2026-71989` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via portFw function](https://agentprime.io/advisories/CVE-2026-71988.md)
  `CVE-2026-71988` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via alg function](https://agentprime.io/advisories/CVE-2026-71987.md)
  `CVE-2026-71987` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via dmz Function](https://agentprime.io/advisories/CVE-2026-71986.md)
  `CVE-2026-71986` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function](https://agentprime.io/advisories/CVE-2026-71985.md)
  `CVE-2026-71985` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via urlfilter](https://agentprime.io/advisories/CVE-2026-71984.md)
  `CVE-2026-71984` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MSI Radix AXE6600 v781521 Command Injection via wps.cgi](https://agentprime.io/advisories/CVE-2026-71983.md)
  `CVE-2026-71983` · CVE record: MSI Radix AXE6600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via app.cgi](https://agentprime.io/advisories/CVE-2026-71956.md)
  `CVE-2026-71956` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formWsc](https://agentprime.io/advisories/CVE-2026-71955.md)
  `CVE-2026-71955` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup](https://agentprime.io/advisories/CVE-2026-71954.md)
  `CVE-2026-71954` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formNtp](https://agentprime.io/advisories/CVE-2026-71953.md)
  `CVE-2026-71953` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup](https://agentprime.io/advisories/CVE-2026-71952.md)
  `CVE-2026-71952` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup](https://agentprime.io/advisories/CVE-2026-71951.md)
  `CVE-2026-71951` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formSmsManage](https://agentprime.io/advisories/CVE-2026-71950.md)
  `CVE-2026-71950` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup](https://agentprime.io/advisories/CVE-2026-71949.md)
  `CVE-2026-71949` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun](https://agentprime.io/advisories/CVE-2026-71948.md)
  `CVE-2026-71948` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun](https://agentprime.io/advisories/CVE-2026-71947.md)
  `CVE-2026-71947` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun](https://agentprime.io/advisories/CVE-2026-71946.md)
  `CVE-2026-71946` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom](https://agentprime.io/advisories/CVE-2026-71945.md)
  `CVE-2026-71945` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel](https://agentprime.io/advisories/CVE-2026-71944.md)
  `CVE-2026-71944` · CVE record: D-Link Corporation DWR-M961 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Command injection
- [MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection](https://agentprime.io/advisories/CVE-2026-19284.md)
  `CVE-2026-19284` · CVE record: MauricioMilano coder-api · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection](https://agentprime.io/advisories/CVE-2026-19282.md)
  `CVE-2026-19282` · CVE record: andreahaku llm_memory_mcp · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection](https://agentprime.io/advisories/CVE-2026-19281.md)
  `CVE-2026-19281` · CVE record: adolfosalasgomez3011 slidev-builder-mcp · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [MIMICLab mcp-pdf-vision index.ts load_pdf command injection](https://agentprime.io/advisories/CVE-2026-19279.md)
  `CVE-2026-19279` · CVE record: MIMICLab mcp-pdf-vision · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection](https://agentprime.io/advisories/CVE-2026-19268.md)
  `CVE-2026-19268` · CVE record: abdullah1854 MCPGateway · CVSS 5.3 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection](https://agentprime.io/advisories/CVE-2026-19266.md)
  `CVE-2026-19266` · CVE record: Kirachon context-engine · CVSS 5.1 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection](https://agentprime.io/advisories/CVE-2026-19263.md)
  `CVE-2026-19263` · CVE record: INQUIRELAB mcp-bridge-api · CVSS 6.9 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection
- [Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension](https://agentprime.io/advisories/CVE-2026-48122.md)
  `CVE-2026-48122` · CVE record: Shopify ruby-lsp · CVSS 5.4 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA4LTA3VDIyOjQwOjIzLjgxMTAwMFoiLCJDVkUtMjAyNi00ODEyMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA4LTEwVDE4OjU5OjMzLjI0ODAwMFoiLCJDVkUtMjAyNi03Mjg3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA4LTEwVDE4OjU5OjMzLjI0ODAwMFoiLCJDVkUtMjAyNi03Mjg3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.