# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd](https://agentprime.io/advisories/CVE-2026-49819.md)
  `CVE-2026-49819` · CVE record: seriousm4x UpSnap · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection, Privilege escalation, Authentication bypass, Broken access control
- [PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in \_style_tag_for](https://agentprime.io/advisories/CVE-2026-17431.md)
  `CVE-2026-17431` · CVE record: MITHALDU PDF::WebKit · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Command injection
- [PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document](https://agentprime.io/advisories/CVE-2026-16770.md)
  `CVE-2026-16770` · CVE record: MITHALDU PDF::WebKit · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd](https://agentprime.io/advisories/CVE-2026-49481.md)
  `CVE-2026-49481` · CVE record: seriousm4x UpSnap · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-13476.md)
  `CVE-2026-13476` · CVE record: IBM Informix Dynamic Server · CVSS 7.3 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-16695.md)
  `CVE-2026-16695` · CVE record: IBM i Access Client Solutions · CVSS 7.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-12005.md)
  `CVE-2026-12005` · CVE record: IBM Security Verify Access and 3 more · CVSS 7.2 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Remote Code Execution Vulnerabilities \[, \]](https://agentprime.io/advisories/CVE-2026-17642.md)
  `CVE-2026-17642` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Remote Code Execution Vulnerabilities \[, \]](https://agentprime.io/advisories/CVE-2026-17417.md)
  `CVE-2026-17417` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration](https://agentprime.io/advisories/CVE-2026-63298.md)
  `CVE-2026-63298` · CVE record: Canonical LXD · CVSS 8.7 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Multiple Vulnerabilities in the Debug Server](https://agentprime.io/advisories/CVE-2026-17248.md)
  `CVE-2026-17248` · CVE record: IBM i · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM Db2 Mirror for i is vulnerable to OS command injection \[\]](https://agentprime.io/advisories/CVE-2026-16956.md)
  `CVE-2026-16956` · CVE record: IBM Db2 Mirror for i · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Multiple Vulnerabilities in Domain Name System](https://agentprime.io/advisories/CVE-2026-16906.md)
  `CVE-2026-16906` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Multiple Vulnerabilities in Domain Name System](https://agentprime.io/advisories/CVE-2026-16856.md)
  `CVE-2026-16856` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Multiple Vulnerabilities in SQL](https://agentprime.io/advisories/CVE-2026-17420.md)
  `CVE-2026-17420` · CVE record: IBM i · CVSS 6.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i](https://agentprime.io/advisories/CVE-2026-18235.md)
  `CVE-2026-18235` · CVE record: IBM i · CVSS 8.3 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [IBM i is Affected By privilege escalation in Navigator for i](https://agentprime.io/advisories/CVE-2026-18683.md)
  `CVE-2026-18683` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution](https://agentprime.io/advisories/CVE-2026-48554.md)
  `CVE-2026-48554` · CVE record: Nagios Enterprises, LLC. Nagios Core and 1 more · CVSS 7.7 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection](https://agentprime.io/advisories/CVE-2026-48553.md)
  `CVE-2026-48553` · CVE record: Nagios Enterprises, LLC. Nagios Core and 1 more · CVSS 7.7 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [Apache Allura: Git command injection](https://agentprime.io/advisories/CVE-2026-73240.md)
  `CVE-2026-73240` · CVE record: Apache Software Foundation Apache Allura · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path](https://agentprime.io/advisories/CVE-2026-73263.md)
  `CVE-2026-73263` · CVE record: prowler-cloud prowler · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection
- [cloudflare/pages-action is deprecated — migration required by September 18th, 2026](https://agentprime.io/advisories/CVE-2026-11325.md)
  `CVE-2026-11325` · CVE record: Cloudflare https\://github.com/cloudflare/pages-action · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection, CWE-1104
- [Notepad++: Install-time PowerShell command injection through installation path](https://agentprime.io/advisories/CVE-2026-73250.md)
  `CVE-2026-73250` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [libgit2 Shell Command Injection via ssh_libssh2 Backend](https://agentprime.io/advisories/CVE-2026-5917.md)
  `CVE-2026-5917` · CVE record: libgit2 libgit2 · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection](https://agentprime.io/advisories/CVE-2026-14863.md)
  `CVE-2026-14863` · CVE record: FileRun FileRun · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Electerm check folder size function may get attacked by unsafe folder name](https://agentprime.io/advisories/CVE-2026-73224.md)
  `CVE-2026-73224` · CVE record: electerm electerm · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70335.md)
  `CVE-2026-70335` · CVE record: Microsoft Visual Studio Code · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Visual Studio Code Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69320.md)
  `CVE-2026-69320` · CVE record: Microsoft Visual Studio Code · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Microsoft Office Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-68792.md)
  `CVE-2026-68792` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 3 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Microsoft Office Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65656.md)
  `CVE-2026-65656` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 3 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Visual Studio Code Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-47285.md)
  `CVE-2026-47285` · CVE record: Microsoft Visual Studio Code · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Azure Monitor Agent Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-47299.md)
  `CVE-2026-47299` · CVE record: Microsoft Azure Monitor Agent Linux Extension · CVSS 7.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Windows Active Directory Domain Services Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-49179.md)
  `CVE-2026-49179` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-48385.md)
  `CVE-2026-48385` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-48362.md)
  `CVE-2026-48362` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Activepieces: Remote Code Execution via Command Injection in Code Step Name](https://agentprime.io/advisories/CVE-2026-73081.md)
  `CVE-2026-73081` · CVE record: activepieces activepieces · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Google Turbinia arbitrary command execution](https://agentprime.io/advisories/CVE-2026-67180.md)
  `CVE-2026-67180` · CVE record: Google Turbinia · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Vim: Arbitrary Code Execution via Netrw Menu Construction](https://agentprime.io/advisories/CVE-2026-73078.md)
  `CVE-2026-73078` · CVE record: vim vim · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection, CWE-184
- [Vim: Arbitrary Code Execution via Shell Keyword Lookup](https://agentprime.io/advisories/CVE-2026-73077.md)
  `CVE-2026-73077` · CVE record: vim vim · CVSS 8.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Command injection vulnerability in some NETGEAR Nighthawk devices](https://agentprime.io/advisories/CVE-2026-11739.md)
  `CVE-2026-11739` · CVE record: NETGEAR MR60 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [wg-easy wg-easy - OS Command Injection](https://agentprime.io/advisories/CVE-2026-72603.md)
  `CVE-2026-72603` · CVE record: wg-easy wg-easy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [ZoneMinder ZoneMinder - Remote Code Execution](https://agentprime.io/advisories/CVE-2026-72556.md)
  `CVE-2026-72556` · CVE record: ZoneMinder ZoneMinder · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [Apioo Fusio - Remote Code Execution](https://agentprime.io/advisories/CVE-2026-72551.md)
  `CVE-2026-72551` · CVE record: Apioo Fusio · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [PrefectHQ Prefect - Argument Injection](https://agentprime.io/advisories/CVE-2026-72538.md)
  `CVE-2026-72538` · CVE record: PrefectHQ Prefect · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform](https://agentprime.io/advisories/CVE-2026-58236.md)
  `CVE-2026-58236` · CVE record: SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform · CVSS 5.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Command injection
- [OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices](https://agentprime.io/advisories/CVE-2025-30241.md)
  `CVE-2025-30241` · CVE record: TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6 and 4 more · CVSS 8.6 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences](https://agentprime.io/advisories/CVE-2026-72913.md)
  `CVE-2026-72913` · CVE record: kovidgoyal kitty · CVSS 7.3 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, Other injection, CWE-150
- [Firecrawl: Arbitrary file read via JSON Schema $ref expansion](https://agentprime.io/advisories/CVE-2026-72904.md)
  `CVE-2026-72904` · CVE record: firecrawl firecrawl · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, Code injection
- [Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById](https://agentprime.io/advisories/CVE-2026-72902.md)
  `CVE-2026-72902` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Remote Code Execution via volume-backup](https://agentprime.io/advisories/CVE-2026-72901.md)
  `CVE-2026-72901` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder](https://agentprime.io/advisories/CVE-2026-72885.md)
  `CVE-2026-72885` · CVE record: Dokploy dokploy · CVSS 0.0 None · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command Injection via Compose Custom Command](https://agentprime.io/advisories/CVE-2026-72884.md)
  `CVE-2026-72884` · CVE record: Dokploy dokploy · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers](https://agentprime.io/advisories/CVE-2026-72882.md)
  `CVE-2026-72882` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command Injection via database credentials in backup/restore commands](https://agentprime.io/advisories/CVE-2026-72881.md)
  `CVE-2026-72881` · CVE record: Dokploy dokploy · CVSS 6.4 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Arbitrary File Write + Remote OS Command Injection via \`certificatePath\`](https://agentprime.io/advisories/CVE-2026-72880.md)
  `CVE-2026-72880` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command Injection via Registry Credentials in Swarm Upload](https://agentprime.io/advisories/CVE-2026-72879.md)
  `CVE-2026-72879` · CVE record: Dokploy dokploy · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments](https://agentprime.io/advisories/CVE-2026-72878.md)
  `CVE-2026-72878` · CVE record: Dokploy dokploy · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Command Injection via dockerImage in buildRemoteDocker](https://agentprime.io/advisories/CVE-2026-72877.md)
  `CVE-2026-72877` · CVE record: Dokploy dokploy · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection
- [Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.\*](https://agentprime.io/advisories/CVE-2026-72876.md)
  `CVE-2026-72876` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, Broken access control
- [Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile](https://agentprime.io/advisories/CVE-2026-72875.md)
  `CVE-2026-72875` · CVE record: Dokploy dokploy · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA4LTEwVDE4OjU5OjMzLjI0ODAwMFoiLCJDVkUtMjAyNi03Mjg3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA4LTEzVDEyOjMxOjA5LjAwMDAwMFoiLCJHSFNBLTZqOWctOGZ4Yy0yNWhxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA4LTEzVDEyOjMxOjA5LjAwMDAwMFoiLCJHSFNBLTZqOWctOGZ4Yy0yNWhxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.