# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [OS command injection in Schneider Electric NetBotz 5 - 750/755](https://agentprime.io/advisories/CVE-2026-13336.md)
  `CVE-2026-13336` · CVE record: Schneider Electric NetBotz 5 - 750/755 · CVSS 7.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname](https://agentprime.io/advisories/CVE-2026-84194.md)
  `CVE-2026-84194` · CVE record: librenms librenms · CVSS 8.6 High · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection](https://agentprime.io/advisories/CVE-2026-84059.md)
  `CVE-2026-84059` · CVE record: ICP DAS UA-2200 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, Command injection
- [yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)](https://agentprime.io/advisories/CVE-2026-25706.md)
  `CVE-2026-25706` · CVE record: SUSE yast2-samba-client · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join](https://agentprime.io/advisories/CVE-2026-59681.md)
  `CVE-2026-59681` · CVE record: SUSE yast2-auth-client · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute](https://agentprime.io/advisories/CVE-2026-59680.md)
  `CVE-2026-59680` · CVE record: SUSE yast2-users · CVSS 8.6 High · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection, CWE-1287
- [Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection](https://agentprime.io/advisories/CVE-2026-83772.md)
  `CVE-2026-83772` · CVE record: Cobham SATCOM VSAT7090 Maritime Satellite Router · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, Command injection
- [OS command injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-67394.md)
  `CVE-2026-67394` · CVE record: WebPros Plesk · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [RedPort Optimizer wXa-223 System Clock datetime.php exec command injection](https://agentprime.io/advisories/CVE-2026-83524.md)
  `CVE-2026-83524` · CVE record: RedPort Optimizer wXa-203 and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection
- [QVidium Opera11 CGI Script net_tr.cgi command injection](https://agentprime.io/advisories/CVE-2026-82971.md)
  `CVE-2026-82971` · CVE record: QVidium Opera11 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection
- [Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection](https://agentprime.io/advisories/CVE-2026-82703.md)
  `CVE-2026-82703` · CVE record: Edimax BR-6214K · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [Command Injection vulnerability in eObčanka-Identifikace](https://agentprime.io/advisories/CVE-2026-59111.md)
  `CVE-2026-59111` · CVE record: Ministry of the Interior (MVČR) eObčanka-Identifikace · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection](https://agentprime.io/advisories/CVE-2026-82702.md)
  `CVE-2026-82702` · CVE record: Edimax BR-6214K · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair](https://agentprime.io/advisories/CVE-2026-19702.md)
  `CVE-2026-19702` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair · CVSS 7.8 High · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection](https://agentprime.io/advisories/CVE-2026-82692.md)
  `CVE-2026-82692` · CVE record: D-Link DNS-340L and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection](https://agentprime.io/advisories/CVE-2026-82691.md)
  `CVE-2026-82691` · CVE record: D-Link DNS-320L and 3 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection](https://agentprime.io/advisories/CVE-2026-82690.md)
  `CVE-2026-82690` · CVE record: D-Link DNS-327L and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection](https://agentprime.io/advisories/CVE-2026-82689.md)
  `CVE-2026-82689` · CVE record: D-Link DNS-320L and 3 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection](https://agentprime.io/advisories/CVE-2026-82688.md)
  `CVE-2026-82688` · CVE record: D-Link DNS-340L and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [diem-project diem Administrative Console actions.class.php executeCommand os command injection](https://agentprime.io/advisories/CVE-2026-82678.md)
  `CVE-2026-82678` · CVE record: diem-project diem · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection](https://agentprime.io/advisories/CVE-2026-82668.md)
  `CVE-2026-82668` · CVE record: klaussilveira GitList · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [TOTOLINK NR1800X cstecgi.cgi setUssd command injection](https://agentprime.io/advisories/CVE-2026-82597.md)
  `CVE-2026-82597` · CVE record: TOTOLINK NR1800X · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection
- [An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.](https://agentprime.io/advisories/CVE-2026-79408.md)
  `CVE-2026-79408` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection](https://agentprime.io/advisories/CVE-2026-82595.md)
  `CVE-2026-82595` · CVE record: D-Link DIR-825M · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection, Command injection
- [OS command injection in Qubes OS](https://agentprime.io/advisories/CVE-2026-82636.md)
  `CVE-2026-82636` · CVE record: Qubes OS Qubes OS · CVSS 7.9 High · Not analysed yet · Published 30 Aug 2026 · Tags: Command injection
- [PowSyBl Core has Command Injection in LocalCommandExecutor-s](https://agentprime.io/advisories/GHSA-jqvf-j3ww-r8c7.md)
  `GHSA-jqvf-j3ww-r8c7`, `CVE-2026-55673` · Maven `com.powsybl:powsybl-computation-local`: affected `<7.2.2`, fixed in `7.2.2` · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values](https://agentprime.io/advisories/CVE-2026-55378.md)
  `CVE-2026-55378` · CVE record: shriyanss js-recon · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name](https://agentprime.io/advisories/CVE-2026-75486.md)
  `CVE-2026-75486` · CVE record: snyk sweater-comb · CVSS 8.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post](https://agentprime.io/advisories/CVE-2026-75123.md)
  `CVE-2026-75123` · CVE record: PLANET Technology Corp. PLANET GS-4210-16P2S V3 · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi](https://agentprime.io/advisories/CVE-2026-75122.md)
  `CVE-2026-75122` · CVE record: PLANET Technology Corp. PLANET GS-4210-16P2S V3 · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post](https://agentprime.io/advisories/CVE-2026-75121.md)
  `CVE-2026-75121` · CVE record: PLANET Technology Corp. PLANET GS-4210-16P2S V3 · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [Green-Computing｜NUMail - OS Command Injection](https://agentprime.io/advisories/CVE-2026-82082.md)
  `CVE-2026-82082` · CVE record: Green-Computing NUMail · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [OS command injection in openNDS](https://agentprime.io/advisories/CVE-2026-38822.md)
  `CVE-2026-38822` · CVE record: openNDS openNDS · CVSS 7.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [OS command injection in openNDS](https://agentprime.io/advisories/CVE-2026-38820.md)
  `CVE-2026-38820` · CVE record: openNDS openNDS · CVSS 8.3 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' par…](https://agentprime.io/advisories/CVE-2026-50979.md)
  `CVE-2026-50979` · CVE record · CVSS 8.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.](https://agentprime.io/advisories/CVE-2026-37751.md)
  `CVE-2026-37751` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Command injection
- [Wazuh: Missing input validation in multiple active response scripts allows argument injection](https://agentprime.io/advisories/CVE-2026-54085.md)
  `CVE-2026-54085` · CVE record: wazuh wazuh · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [Xiiaozet LK100W OS Command Injection](https://agentprime.io/advisories/CVE-2026-78037.md)
  `CVE-2026-78037` · CVE record: Xiiaozet Xiiaozet LK100W · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [OS Command Injection in PayRange API](https://agentprime.io/advisories/CVE-2026-76060.md)
  `CVE-2026-76060` · CVE record: Zoneminder Zoneminder · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [Connection-option injection via unescaped settings in the canonical MongoDB URL builder](https://agentprime.io/advisories/CVE-2026-81529.md)
  `CVE-2026-81529` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers ca...](https://agentprime.io/advisories/GHSA-gw2m-mj6q-59hc.md)
  `GHSA-gw2m-mj6q-59hc`, `CVE-2026-81698`, `PYSEC-2026-3776` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape](https://agentprime.io/advisories/CVE-2026-81097.md)
  `CVE-2026-81097` · CVE record: maquina-app rails-mcp-server · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)](https://agentprime.io/advisories/CVE-2026-57499.md)
  `CVE-2026-57499` · CVE record: limanmys core · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection, CWE-20
- [AlexGladkov claude-in-mobile client.ts execSync os command injection](https://agentprime.io/advisories/CVE-2026-81562.md)
  `CVE-2026-81562` · CVE record: AlexGladkov claude-in-mobile · CVSS 4.8 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [Zbtlink MQWrt infosrvd Command Injection](https://agentprime.io/advisories/CVE-2026-74233.md)
  `CVE-2026-74233` · CVE record: Zbtlink WE1326 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection, Hard-coded credentials
- [An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17).](https://agentprime.io/advisories/CVE-2026-26899.md)
  `CVE-2026-26899` · CVE record · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection
- [OS command injection in Dell PowerProtect One](https://agentprime.io/advisories/CVE-2026-74770.md)
  `CVE-2026-74770` · CVE record: Dell PowerProtect One · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [OS command injection in Dell PowerProtect One](https://agentprime.io/advisories/CVE-2026-68861.md)
  `CVE-2026-68861` · CVE record: Dell PowerProtect One · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [OS command injection in Dell Cloud Disaster Recovery](https://agentprime.io/advisories/CVE-2026-71171.md)
  `CVE-2026-71171` · CVE record: Dell Cloud Disaster Recovery · CVSS 7.2 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [OS command injection in Dell Cloud Disaster Recovery](https://agentprime.io/advisories/CVE-2026-70419.md)
  `CVE-2026-70419` · CVE record: Dell Cloud Disaster Recovery · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter](https://agentprime.io/advisories/CVE-2026-80427.md)
  `CVE-2026-80427` · CVE record: nfriedly bestzip · CVSS 8.6 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling](https://agentprime.io/advisories/CVE-2026-19042.md)
  `CVE-2026-19042` · CVE record: TeamViewer Full Client and 1 more · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [LibreNMS Virtualisation Discovery Module RCE](https://agentprime.io/advisories/CVE-2026-80214.md)
  `CVE-2026-80214` · CVE record: librenms librenms · CVSS 8.6 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter.](https://agentprime.io/advisories/CVE-2026-75364.md)
  `CVE-2026-75364` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n.](https://agentprime.io/advisories/CVE-2026-75363.md)
  `CVE-2026-75363` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.](https://agentprime.io/advisories/CVE-2026-52473.md)
  `CVE-2026-52473` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [An issue was discovered in LibreNMS 1.65.](https://agentprime.io/advisories/CVE-2020-15874.md)
  `CVE-2020-15874` · CVE record · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: Command injection
- [TOTOLINK N600R cstecgi.cgi getCurrentTime command injection](https://agentprime.io/advisories/CVE-2026-79912.md)
  `CVE-2026-79912` · CVE record: TOTOLINK N600R · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Other injection, Command injection
- [ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter](https://agentprime.io/advisories/CVE-2026-80138.md)
  `CVE-2026-80138` · CVE record: MacWarrior clipbucket-v5 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection](https://agentprime.io/advisories/CVE-2026-79792.md)
  `CVE-2026-79792` · CVE record: zackees transcribe-anything · CVSS 6.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA4LTI1VDIwOjMwOjEwLjAyMjAwMFoiLCJDVkUtMjAyNi03OTc5MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA5LTAxVDEzOjUyOjUwLjA5MTAwMFoiLCJDVkUtMjAyNi01ODU3MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA5LTAxVDEzOjUyOjUwLjA5MTAwMFoiLCJDVkUtMjAyNi01ODU3MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.