# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-91102.md)
  `CVE-2026-91102` · CVE record: HP Inc. HP Linux Imaging and Printing Software (HPLIP) · CVSS 8.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-91100.md)
  `CVE-2026-91100` · CVE record: HP Inc. HP Linux Imaging and Printing Software (HPLIP) · CVSS 6.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Cisco Identity Services Engine Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20305.md)
  `CVE-2026-20305` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Cisco Identity Services Engine Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20306.md)
  `CVE-2026-20306` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Dell Update Package Framework](https://agentprime.io/advisories/CVE-2026-71179.md)
  `CVE-2026-71179` · CVE record: Dell Update Package Framework · CVSS 7.3 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Ruijie RG-EW3000GX user_list_note admin os command injection](https://agentprime.io/advisories/CVE-2026-92398.md)
  `CVE-2026-92398` · CVE record: Ruijie RG-EW3000GX · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection](https://agentprime.io/advisories/CVE-2026-92397.md)
  `CVE-2026-92397` · CVE record: Ruijie RG-EW3000GX · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73176.md)
  `CVE-2026-73176` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73172.md)
  `CVE-2026-73172` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73167.md)
  `CVE-2026-73167` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73165.md)
  `CVE-2026-73165` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73164.md)
  `CVE-2026-73164` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73163.md)
  `CVE-2026-73163` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers](https://agentprime.io/advisories/CVE-2026-58147.md)
  `CVE-2026-58147` · CVE record: WNC T-Mobile 5G Box IDU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Unauthorized remote code execution in T-Mobile 5G Box IDU routers](https://agentprime.io/advisories/CVE-2026-58146.md)
  `CVE-2026-58146` · CVE record: WNC T-Mobile 5G Box IDU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in T-Mobile 5G Box IDU router via ping functionality](https://agentprime.io/advisories/CVE-2026-40855.md)
  `CVE-2026-40855` · CVE record: WNC T-Mobile 5G Box IDU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Security Advisory 0165](https://agentprime.io/advisories/CVE-2026-73454.md)
  `CVE-2026-73454` · CVE record: Arista Networks EOS · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Remote code execution via uploading a malicious IODD file](https://agentprime.io/advisories/CVE-2026-27565.md)
  `CVE-2026-27565` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection via PUT in /api/datastorage/data](https://agentprime.io/advisories/CVE-2026-27564.md)
  `CVE-2026-27564` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection via GET in /api/datastorage/data](https://agentprime.io/advisories/CVE-2026-27563.md)
  `CVE-2026-27563` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection via PUT in /api/iodd/config](https://agentprime.io/advisories/CVE-2026-27562.md)
  `CVE-2026-27562` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection via GET in /api/iodd/config](https://agentprime.io/advisories/CVE-2026-27561.md)
  `CVE-2026-27561` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection via DELETE in /api/status/data](https://agentprime.io/advisories/CVE-2026-27560.md)
  `CVE-2026-27560` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection via GET in /api/status/data](https://agentprime.io/advisories/CVE-2026-27559.md)
  `CVE-2026-27559` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files](https://agentprime.io/advisories/CVE-2026-27558.md)
  `CVE-2026-27558` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in /index.php/ajax/save_iodd_parameters](https://agentprime.io/advisories/CVE-2026-27554.md)
  `CVE-2026-27554` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in /index.php/ajax/parameterManage](https://agentprime.io/advisories/CVE-2026-27551.md)
  `CVE-2026-27551` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in Field_Shadow_Password Class](https://agentprime.io/advisories/CVE-2026-27550.md)
  `CVE-2026-27550` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in /index.php/attached_devices_tab/do_upload](https://agentprime.io/advisories/CVE-2026-27549.md)
  `CVE-2026-27549` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in /index.php/ajax/get_iodd_port_info](https://agentprime.io/advisories/CVE-2026-27548.md)
  `CVE-2026-27548` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in /index.php/ajax/get_iodd_menu_info](https://agentprime.io/advisories/CVE-2026-27547.md)
  `CVE-2026-27547` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request](https://agentprime.io/advisories/CVE-2026-73447.md)
  `CVE-2026-73447` · CVE record: Arista Networks EOS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Security Advisory 0181](https://agentprime.io/advisories/CVE-2026-86108.md)
  `CVE-2026-86108` · CVE record: Arista Networks VeloCloud Edge · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters](https://agentprime.io/advisories/CVE-2026-76866.md)
  `CVE-2026-76866` · CVE record: Netcore NR255-V · CVSS 8.6 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths](https://agentprime.io/advisories/CVE-2026-76862.md)
  `CVE-2026-76862` · CVE record: Netcore NR255-V · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling](https://agentprime.io/advisories/CVE-2026-10144.md)
  `CVE-2026-10144` · CVE record: web-infra-dev rsbuild · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite](https://agentprime.io/advisories/CVE-2026-54337.md)
  `CVE-2026-54337` · CVE record: ShaneIsrael fireshare · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways](https://agentprime.io/advisories/CVE-2026-76698.md)
  `CVE-2026-76698` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways](https://agentprime.io/advisories/CVE-2026-76690.md)
  `CVE-2026-76690` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 7.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways](https://agentprime.io/advisories/CVE-2026-76675.md)
  `CVE-2026-76675` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow](https://agentprime.io/advisories/CVE-2026-58502.md)
  `CVE-2026-58502` · CVE record: gouef githubtoplanguages · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab](https://agentprime.io/advisories/CVE-2026-88765.md)
  `CVE-2026-88765` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection](https://agentprime.io/advisories/CVE-2026-91853.md)
  `CVE-2026-91853` · CVE record: TOTOLINK X5000R · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Flowise before 3.1.4 Script Injection via Docker Workflows](https://agentprime.io/advisories/CVE-2026-91936.md)
  `CVE-2026-91936` · CVE record: FlowiseAI Flowise · CVSS 8.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Flowise before 3.1.4 Remote Code Execution via Custom MCP npx](https://agentprime.io/advisories/CVE-2026-91931.md)
  `CVE-2026-91931` · CVE record: FlowiseAI Flowise · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters](https://agentprime.io/advisories/CVE-2026-85013.md)
  `CVE-2026-85013` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Conflibot: Command injection via crafted pull request branch names under pull_request_target](https://agentprime.io/advisories/CVE-2026-55158.md)
  `CVE-2026-55158` · CVE record: wktk conflibot · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Arbitrary command execution in TrxTimeATTENDANCE](https://agentprime.io/advisories/CVE-2026-89308.md)
  `CVE-2026-89308` · CVE record: TREXOM TrxTimeATTENDANCE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution](https://agentprime.io/advisories/CVE-2026-19515.md)
  `CVE-2026-19515` · CVE record: WSO2 WSO2 Integrator: MI for Visual Studio Code · CVSS 7.0 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [OS command injection in LITE-ON Technology Corporation FF-RFI079I4 and others](https://agentprime.io/advisories/CVE-2026-77853.md)
  `CVE-2026-77853` · CVE record: LITE-ON Technology Corporation FF-RFI079I4 and 1 more · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection](https://agentprime.io/advisories/CVE-2026-90880.md)
  `CVE-2026-90880` · CVE record: D-Link DSL-3782 · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Other injection, Command injection
- [EFM ipTIME C200E System Setup iux_set.cgi os command injection](https://agentprime.io/advisories/CVE-2026-90847.md)
  `CVE-2026-90847` · CVE record: EFM ipTIME C200E · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection](https://agentprime.io/advisories/CVE-2026-90843.md)
  `CVE-2026-90843` · CVE record: SabyasachiRana WebMap · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component](https://agentprime.io/advisories/CVE-2026-52484.md)
  `CVE-2026-52484` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-14275.md)
  `CVE-2026-14275` · CVE record: IBM i Access Family · CVSS 6.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-14276.md)
  `CVE-2026-14276` · CVE record: IBM i Access Family · CVSS 6.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-14277.md)
  `CVE-2026-14277` · CVE record: IBM i Access Family · CVSS 6.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-16466.md)
  `CVE-2026-16466` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-16673.md)
  `CVE-2026-16673` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs](https://agentprime.io/advisories/CVE-2026-17133.md)
  `CVE-2026-17133` · CVE record: IBM App Connect Enterprise · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA5LTE0VDE5OjQxOjIzLjQ5MTAwMFoiLCJDVkUtMjAyNi0xNzEzMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA5LTE2VDIwOjA2OjUwLjY0NDAwMFoiLCJDVkUtMjAyNi0yMDMyNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA5LTE2VDIwOjA2OjUwLjY0NDAwMFoiLCJDVkUtMjAyNi0yMDMyNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.