Advisories · Weakness

Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-32183 CVE record

CVSS 7.8 High

Windows Snipping Tool Remote Code Execution Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Command injection
Not analysed yet 14 Apr 2026
CVE-2026-23653 CVE record

CVSS 5.7 Medium

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
- Microsoft Visual Studio Code CoPilot Chat Extension
- Command injection
Not analysed yet 14 Apr 2026
CVE-2026-39808 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

OS command injection in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Command injection
Not analysed yet 14 Apr 2026
CVE-2026-2449 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Argument injection in upKeeper Solutions upKeeper Instant Privilege Access
- upKeeper Solutions upKeeper Instant Privilege Access
- Command injection
Not analysed yet 14 Apr 2026
CVE-2026-39420 CVE record

CVSS 6.3 Medium

MaxKB: Sandbox escape via LD_PRELOAD bypass
- 1Panel-dev MaxKB
- Command injection
- CWE-693
Not analysed yet 14 Apr 2026
@aiondadotcom/mcp-ssh npm

CVSS 4.0, no score published

SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
- Command injection
<1.3.5 · fixed in 1.3.5

GHSA-p4h8-56qp-hpgv Not analysed yet 14 Apr 2026
CVE-2026-39417 CVE record

CVSS 4.6 Medium

MaxKB: RCE via MCP stdio command injection in workflow engine
- 1Panel-dev MaxKB
- Command injection
- CWE-20
Not analysed yet 14 Apr 2026
CVE-2026-4786 CVE record

CVSS 7.0 High

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
- Python Software Foundation CPython
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6219 CVE record

CVSS 4.8 Medium

aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection
- aandrew-me ytDownloader
- Other injection
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6195 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
gov.nsa.emissary:emissary Maven

CVSS 8.8 High

Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
- Command injection
- CWE-116
<8.43.0 · fixed in 8.43.0

GHSA-3p24-9x7v-7789 · CVE-2026-35582 Not analysed yet 13 Apr 2026
simple-git npm

CVSS 8.1 High

simple-git Affected by Command Execution via Option-Parsing Bypass
- Command injection
<3.32.0 · fixed in 3.32.0

GHSA-jcxm-m3jx-f287 · CVE-2026-28291 Not analysed yet 13 Apr 2026
CVE-2026-34188 CVE record

CVSS 7.5 High

OS Command Injection in Event Response Execution
- Pandora FMS
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-30809 CVE record

CVSS 8.7 High

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution
- Pandora FMS
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-30806 CVE record

CVSS 8.7 High

OS Command Injection in Network Report leads to Remote Code Execution
- Pandora FMS
- Command injection
Not analysed yet 13 Apr 2026
librenms/librenms Packagist

CVSS 4.0, no score published

Duplicate Advisory: LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
- Command injection
<26.3.0 · fixed in 26.3.0

GHSA-7549-ggpq-22w8 Withdrawn Not analysed yet 13 Apr 2026
CVE-2026-6158 CVE record

CVSS 6.9 Medium

Totolink N300RH upgrade.so setUpgradeUboot os command injection
- Totolink N300RH
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6156 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6155 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6154 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6141 CVE record

CVSS 5.3 Medium

danielmiessler Personal_AI_Infrastructure parse_url.ts os command injection
- danielmiessler Personal_AI_Infrastructure
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6140 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6139 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6138 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 13 Apr 2026
CVE-2026-6132 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6131 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6130 CVE record

CVSS 6.9 Medium

chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection
- chatbox
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6118 CVE record

CVSS 5.3 Medium

AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection
- AstrBot
- Other injection
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6116 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6115 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6114 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6113 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6112 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 12 Apr 2026
CVE-2026-6108 CVE record

CVSS 5.3 Medium

1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection
- 1Panel-dev MaxKB
- Command injection
Not analysed yet 12 Apr 2026
aws-mcp PyPI

CVSS 9.8 CriticalCritical · CVSS 9+

aws-mcp has a Command Injection Remote Code Execution Vulnerability
- Command injection
<=1.7.0 · no fixed version yet

GHSA-fgmx-xfp3-w28p · CVE-2026-5059 Not analysed yet 11 Apr 2026
CVE-2026-4157 CVE record

CVSS 7.5 High

ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability
- ChargePoint Home Flex
- Command injection
Not analysed yet 11 Apr 2026
CVE-2026-5058 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

aws-mcp-server Command Injection Remote Code Execution Vulnerability
- aws-mcp-server
- Command injection
Not analysed yet 11 Apr 2026
praisonai PyPI

CVSS 8.4 High

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
- Command injection
<4.5.128 · fixed in 4.5.128

GHSA-fvxx-ggmx-3cjg · CVE-2026-40113 Not analysed yet 10 Apr 2026
CVE-2026-32892 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

OS Command Injection in Chamilo LMS 1.11.36
- chamilo-lms
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-6029 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-6028 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-6027 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-6026 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-6025 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-5997 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-5996 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-5995 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-5994 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-5993 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 10 Apr 2026
CVE-2026-33791 CVE record

CVSS 8.4 High

Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- Command injection
Not analysed yet 9 Apr 2026
metagpt PyPI

CVSS 6.9 Medium

FoundationAgents MetaGPT vulnerable to os command injection via the Terminal.run_command
- Command injection
<0.8.2 · fixed in 0.8.2

GHSA-wp29-qmvj-frvp · CVE-2026-5972 Not analysed yet 9 Apr 2026
metagpt PyPI

CVSS 6.9 Medium

FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/utils/common.py
- Command injection
<=0.8.1 · no fixed version yet

GHSA-qw5f-qpq5-ppfg · CVE-2026-5973 Not analysed yet 9 Apr 2026
metagpt PyPI

CVSS 6.9 Medium

FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/tools/libs/terminal.py
- Command injection
<=0.8.1 · no fixed version yet

GHSA-fcc8-4q7h-wvwc · CVE-2026-5974 Not analysed yet 9 Apr 2026
CVE-2026-5978 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 9 Apr 2026
openclaw npm

CVSS 5.8 Medium

OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)
- Command injection
- CWE-184
<2026.4.8 · fixed in 2026.4.8

GHSA-cm8v-2vh9-cxf3 · CVE-2026-41915 Not analysed yet 9 Apr 2026
CVE-2026-5977 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 9 Apr 2026
CVE-2026-5976 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 9 Apr 2026
CVE-2026-5975 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection
- Totolink A7100RU
- Command injection
Not analysed yet 9 Apr 2026
openclaw npm

CVSS 4.0, no score published

OpenClaw Host-Exec Environment Variable Injection
- Command injection
<2026.4.8 · fixed in 2026.4.8

GHSA-w9j9-w4cp-6wgr Not analysed yet 9 Apr 2026
openclaw npm

CVSS 5.8 Medium

OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
- Command injection
- CWE-184
<2026.4.8 · fixed in 2026.4.8

GHSA-7437-7hg8-frrw · CVE-2026-42427 Not analysed yet 9 Apr 2026