# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [OS command injection in NVIDIA OpenShell](https://agentprime.io/advisories/CVE-2026-65086.md)
  `CVE-2026-65086` · CVE record: NVIDIA OpenShell · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [OS command injection in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65089.md)
  `CVE-2026-65089` · CVE record: NVIDIA NemoClaw · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [OS command injection in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65090.md)
  `CVE-2026-65090` · CVE record: NVIDIA NemoClaw · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [OS command injection in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65099.md)
  `CVE-2026-65099` · CVE record: NVIDIA NemoClaw · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [OS command injection in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65096.md)
  `CVE-2026-65096` · CVE record: NVIDIA NemoClaw · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [OS command injection in NVIDIA OpenShell](https://agentprime.io/advisories/CVE-2026-65091.md)
  `CVE-2026-65091` · CVE record: NVIDIA OpenShell · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Improper Validation of SSH Target in Okta Privileged Access Client](https://agentprime.io/advisories/CVE-2026-77585.md)
  `CVE-2026-77585` · CVE record: Okta Okta Privileged Access Client · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution](https://agentprime.io/advisories/GHSA-w3fx-mc44-mf6j.md)
  `GHSA-w3fx-mc44-mf6j`, `CVE-2026-45018`, `PYSEC-2026-3812` · PyPI `chainlit`: affected `>=2.4.0rc0, <2.12.0`, fixed in `2.12.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)](https://agentprime.io/advisories/GHSA-3h2g-j4wp-7qqq.md)
  `GHSA-3h2g-j4wp-7qqq` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-76195.md)
  `CVE-2026-76195` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-76197.md)
  `CVE-2026-76197` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Emacs: emacs: command injection via crafted filenames in tramp](https://agentprime.io/advisories/CVE-2026-79992.md)
  `CVE-2026-79992` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Command injection in NVIDIA Unified Fabric Manager Enterprise - GA and others](https://agentprime.io/advisories/CVE-2026-24168.md)
  `CVE-2026-24168` · CVE record: NVIDIA Unified Fabric Manager Enterprise - GA and 3 more · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Command injection in NVIDIA Unified Fabric Manager Enterprise - GA and others](https://agentprime.io/advisories/CVE-2026-24167.md)
  `CVE-2026-24167` · CVE record: NVIDIA Unified Fabric Manager Enterprise - GA and 3 more · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Command injection in NVIDIA Unified Fabric Manager Enterprise - GA and others](https://agentprime.io/advisories/CVE-2026-24169.md)
  `CVE-2026-24169` · CVE record: NVIDIA Unified Fabric Manager Enterprise - GA and 3 more · CVSS 8.0 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist](https://agentprime.io/advisories/GHSA-f5pj-2738-996m.md)
  `GHSA-f5pj-2738-996m`, `CVE-2026-55580`, `GO-2026-6292` · Go `github.com/sonirico/mcp-shell`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [mcp-shell has a Secure Mode Allowlist Bypass via Default \`/bin/bash\` Executable](https://agentprime.io/advisories/GHSA-3x77-wg38-92r3.md)
  `GHSA-3x77-wg38-92r3`, `CVE-2026-55581`, `GO-2026-6290` · Go `github.com/sonirico/mcp-shell`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 8.4 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection, CWE-183, CWE-1188
- [mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias](https://agentprime.io/advisories/GHSA-74hp-mggr-hv58.md)
  `GHSA-74hp-mggr-hv58`, `CVE-2026-55582`, `GO-2026-6291` · Go `github.com/sonirico/mcp-shell`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 8.4 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [FishCodeTech Muteki Default Local Worker Backend settings.json os command injection](https://agentprime.io/advisories/CVE-2026-79623.md)
  `CVE-2026-79623` · CVE record: FishCodeTech Muteki · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface](https://agentprime.io/advisories/CVE-2026-63586.md)
  `CVE-2026-63586` · CVE record: Weidmueller Interface IE-SR-2TX-WL and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection](https://agentprime.io/advisories/CVE-2026-78637.md)
  `CVE-2026-78637` · CVE record: Fdawgs node-poppler · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, Command injection
- [Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()](https://agentprime.io/advisories/GHSA-89ff-m8wv-p99r.md)
  `GHSA-89ff-m8wv-p99r` · PyPI `gitpython`: affected `<=3.1.58`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE](https://agentprime.io/advisories/GHSA-9557-234j-7rv9.md)
  `GHSA-9557-234j-7rv9` · PyPI `gitpython`: affected `<=3.1.58`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection](https://agentprime.io/advisories/CVE-2026-78430.md)
  `CVE-2026-78430` · CVE record: sworddut mcp-ffmpeg-helper · CVSS 4.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [Command Injection in Parent Control of TP-Link Archer BE3600 v1](https://agentprime.io/advisories/CVE-2026-78541.md)
  `CVE-2026-78541` · CVE record: TP-Link Systems Inc. Archer BE3600 v1 · CVSS 8.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [Command Injection Vulnerability in VPN connection of Archer BE800](https://agentprime.io/advisories/CVE-2026-16348.md)
  `CVE-2026-16348` · CVE record: TP-Link Systems Inc. Archer BE800 v1 · CVSS 8.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices](https://agentprime.io/advisories/CVE-2026-9254.md)
  `CVE-2026-9254` · CVE record: TP-Link Systems Inc. Archer BE800 V1 and 2 more · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet](https://agentprime.io/advisories/CVE-2026-71943.md)
  `CVE-2026-71943` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade](https://agentprime.io/advisories/CVE-2026-71931.md)
  `CVE-2026-71931` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via setTime](https://agentprime.io/advisories/CVE-2026-71930.md)
  `CVE-2026-71930` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto](https://agentprime.io/advisories/CVE-2026-71929.md)
  `CVE-2026-71929` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice](https://agentprime.io/advisories/CVE-2026-71928.md)
  `CVE-2026-71928` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice](https://agentprime.io/advisories/CVE-2026-71927.md)
  `CVE-2026-71927` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice](https://agentprime.io/advisories/CVE-2026-71926.md)
  `CVE-2026-71926` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail](https://agentprime.io/advisories/CVE-2026-71925.md)
  `CVE-2026-71925` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via getVid](https://agentprime.io/advisories/CVE-2026-71924.md)
  `CVE-2026-71924` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set](https://agentprime.io/advisories/CVE-2026-71923.md)
  `CVE-2026-71923` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi](https://agentprime.io/advisories/CVE-2026-71921.md)
  `CVE-2026-71921` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot](https://agentprime.io/advisories/CVE-2026-71919.md)
  `CVE-2026-71919` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction](https://agentprime.io/advisories/CVE-2026-71918.md)
  `CVE-2026-71918` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace](https://agentprime.io/advisories/CVE-2026-71917.md)
  `CVE-2026-71917` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable](https://agentprime.io/advisories/CVE-2026-71916.md)
  `CVE-2026-71916` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus](https://agentprime.io/advisories/CVE-2026-71915.md)
  `CVE-2026-71915` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm](https://agentprime.io/advisories/CVE-2026-71914.md)
  `CVE-2026-71914` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi](https://agentprime.io/advisories/CVE-2026-71913.md)
  `CVE-2026-71913` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via apautotest](https://agentprime.io/advisories/CVE-2026-71910.md)
  `CVE-2026-71910` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via InquierTime](https://agentprime.io/advisories/CVE-2026-71909.md)
  `CVE-2026-71909` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test](https://agentprime.io/advisories/CVE-2026-71908.md)
  `CVE-2026-71908` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via setcamset](https://agentprime.io/advisories/CVE-2026-71907.md)
  `CVE-2026-71907` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via setLan](https://agentprime.io/advisories/CVE-2026-71906.md)
  `CVE-2026-71906` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings](https://agentprime.io/advisories/CVE-2026-71905.md)
  `CVE-2026-71905` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform](https://agentprime.io/advisories/CVE-2026-71904.md)
  `CVE-2026-71904` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [OS command injection in Black Duck blackduck-c-cpp](https://agentprime.io/advisories/CVE-2026-76055.md)
  `CVE-2026-76055` · CVE record: Black Duck blackduck-c-cpp · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [OS command injection in Sakura Editor](https://agentprime.io/advisories/CVE-2026-59561.md)
  `CVE-2026-59561` · CVE record: Sakura Editor Development Community Sakura Editor · CVSS 8.4 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection](https://agentprime.io/advisories/CVE-2026-78211.md)
  `CVE-2026-78211` · CVE record: 4MOSAn Security Technology 4MOSAn GCB Doctor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection](https://agentprime.io/advisories/CVE-2026-78177.md)
  `CVE-2026-78177` · CVE record: TanStack devtools-vite · CVSS 2.0 Low · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.](https://agentprime.io/advisories/CVE-2025-26237.md)
  `CVE-2025-26237` · CVE record · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [Tenda CH22 exeCommand formexeCommand command injection](https://agentprime.io/advisories/CVE-2026-78141.md)
  `CVE-2026-78141` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, Command injection
- [Tenda CH22 editFileName formeditFileName command injection](https://agentprime.io/advisories/CVE-2026-78063.md)
  `CVE-2026-78063` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, Command injection
- [hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection](https://agentprime.io/advisories/CVE-2026-68766.md)
  `CVE-2026-68766` · CVE record: hashcat hashcat · CVSS 8.5 High · Not analysed yet · Published 22 Aug 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA4LTIyVDE0OjEyOjQyLjc0ODAwMFoiLCJDVkUtMjAyNi02ODc2NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA4LTI1VDIwOjMwOjEwLjAyMjAwMFoiLCJDVkUtMjAyNi03OTc5MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA4LTI1VDIwOjMwOjEwLjAyMjAwMFoiLCJDVkUtMjAyNi03OTc5MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.