Advisories · Weakness
Command injection.
Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.8 High
Visual Studio Code Elevation of Privilege Vulnerability
- Microsoft Visual Studio Code
- Command injection
- Authentication bypass
- CVSS 7.8 High
Visual Studio Code Remote Code Execution Vulnerability
- Microsoft Visual Studio Code
- Command injection
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
OS command injection in Fortinet FortiAP and others
- Fortinet FortiAP
- Fortinet FortiAP-W2
- Command injection
- CVSS 6.1 Medium
OS command injection in Fortinet FortiAP-U and others
- Fortinet FortiAP-U
- Fortinet FortiAP-W2
- Command injection
- CVSS 4.0 Medium
Argument injection in Fortinet FortiDeceptor
- Fortinet FortiDeceptor
- Command injection
- CVSS 8.4 High
JunoClaw: plugin-shell shell-metacharacter injection via shell wrapper
- Dragonmonk111 junoclaw
- Command injection
- CVSS 8.4 High
JunoClaw: plugin-shell shell-injection bypass via substring blocklist
- Dragonmonk111 junoclaw
- Command injection
- CWE-184
- CVSS 10.0 CriticalCritical · CVSS 9+
Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`
- Command injection
- Authentication bypass
<2.13.0 · fixed in 2.13.0
GHSA-v25v-m36w-jp4h · CVE-2026-45087 - CVSS 7.8 High
protobuf.js is Vulnerable to OS Command Injection in the CLI
- Command injection
<1.2.1 || >=2.0.0, <2.0.2 · fixed in 1.2.1, 2.0.2
GHSA-f84p-cvgm-xgjj · CVE-2026-42290 - CVSS 7.2 High
OS command injection in ivanti Virtual Traffic Manager
- ivanti Virtual Traffic Manager
- Command injection
- CVSS 8.2 High
OS command injection in Dell PowerScale InsightIQ
- Dell PowerScale InsightIQ
- Command injection
- CVSS 8.9 High
OS command injection in Siemens RUGGEDCOM ROX MX5000 and others
- Siemens RUGGEDCOM ROX MX5000
- Siemens RUGGEDCOM ROX MX5000RE
- Command injection
- CVSS 6.1 Medium
Argument injection in Siemens RUGGEDCOM ROX MX5000 and others
- Siemens RUGGEDCOM ROX MX5000
- Siemens RUGGEDCOM ROX MX5000RE
- Command injection
- CVSS 7.7 High
OS command injection in Siemens RUGGEDCOM ROX MX5000 and others
- Siemens RUGGEDCOM ROX MX5000
- Siemens RUGGEDCOM ROX MX5000RE
- Command injection
- CVSS 8.8 High
OS command injection in Zyxel WRE6505 v2 firmware
- Zyxel WRE6505 v2 firmware
- Command injection
- CVSS 6.5 Medium
OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform
- Command injection
- CVSS 8.2 High
OS Command Injection Vulnerability in SAP Forecasting & Replenishment
- SAP_SE SAP Forecasting & Replenishment
- Command injection
- CVSS 8.5 High
Local privilege escalation to SYSTEM in Cribl Edge for Windows
- Cribl Edge
- Command injection
- Broken access control
- CVSS 8.5 High
Local privilege escalation in Cribl Edge for Linux
- Cribl Edge
- Command injection
- CWE-20
- CVSS 9.8 CriticalCritical · CVSS 9+
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py).
- Command injection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS file operation utilities.
- Command injection
- CVSS 5.3 Medium
D-Link DIR-816 portForward command injection
- D-Link DIR-816
- Other injection
- Command injection
- CVSS 5.3 Medium
D-Link DIR-816 singlePortForward sub_445E7C command injection
- D-Link DIR-816
- Other injection
- Command injection
- CVSS 5.3 Medium
D-Link DIR-816 formDMZ.cgi sub_445E7C command injection
- D-Link DIR-816
- Other injection
- Command injection
- CVSS 8.1 High
automagik-genie has a command injection vulnerability
- Command injection
=2.5.27 · no fixed version yet
GHSA-64vr-4gr2-m642 · CVE-2026-30635 - CVSS 8.7 High
pgAdmin 4: OS command injection vulnerability in Import/Export query export
- Command injection
- SQL injection
<9.15 · fixed in 9.15
GHSA-j74f-g7vx-fh4x · CVE-2026-7816 - CVSS 6.5 Medium
GPT-Pilot contains a command injection vulnerability in the Executor.run() method
- Command injection
<=0.0.10 · no fixed version yet
GHSA-m85w-whwh-qvfx · CVE-2026-31246 - CVSS 9.8 CriticalCritical · CVSS 9+
WebdriverIO BrowserStack Service has a Command Injection issue
- Command injection
<9.24.0 · fixed in 9.24.0
GHSA-5c46-x3qw-q7j7 · CVE-2026-25244 - CVSS 8.8 High
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
- Command injection
- Code injection
<1.4.39 · fixed in 1.4.39
GHSA-w2pm-x38x-jp44 · CVE-2026-44346 - CVSS 8.8 High
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
- Command injection
<1.4.39 · fixed in 1.4.39
GHSA-78f9-r8mh-4xm2 · CVE-2026-44345 - CVSS 8.0 High
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Command injection
- CVSS 5.1 Medium
D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection
- D-Link DNS-320
- Command injection
- CVSS 5.1 Medium
D-Link DNS-320 webfile_mgr.cgi chown os command injection
- D-Link DNS-320
- Command injection
- CVSS 5.1 Medium
D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection
- D-Link DNS-320
- Command injection
- CVSS 5.1 Medium
Tenda AC6 httpd getLogFile get_log_file os command injection
- Tenda AC6
- Command injection
- CVSS 5.3 Medium
Tenda AC6 httpd WifiApScan formWifiApScan os command injection
- Tenda AC6
- Command injection
- CVSS 5.1 Medium
Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection
- Tenda AC6
- Command injection
- CVSS 5.1 Medium
Tenda AC6 httpd telnet os command injection
- Tenda AC6
- Command injection
- CVSS 7.3 High
D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd.
- Command injection
- CVSS 8.8 High
EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection.
- Command injection
- CVSS 5.1 Medium
8421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection
- 8421bit MiniClaw
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 login.cgi sys_login1 os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 wireless.cgi WifiBasic os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 wireless.cgi advance os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 adm.cgi wzdapMesh os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection
- Industrial Application Software IAS Canias ERP
- Command injection
- CVSS 6.5 Medium
Argument injection in Hex-Rays IDA
- Hex-Rays IDA
- Command injection
- CVSS 4.8 Medium
aandrew-me tgpt Update helper.go helper.Update command injection
- aandrew-me tgpt
- Other injection
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 adm.cgi wzdap os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 adm.cgi wifi_region os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 adm.cgi wan os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 adm.cgi wzdrepeater os command injection
- Wavlink NU516U1
- Command injection
- CVSS 5.3 Medium
Wavlink NU516U1 adm.cgi change_wifi_password os command injection
- Wavlink NU516U1
- Command injection
- CVSS 7.2 High
OS command injection in Hikvision DS-3E1310P-SI and others
- Hikvision DS-3E1310P-SI
- Hikvision DS-3E1318P-SI
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
- Command injection
<=1.4.12 · no fixed version yet
GHSA-v6wj-c83f-v46x - CVSS 9.9 CriticalCritical · CVSS 9+
Termix: OS Command Injection in Docker Container Management Endpoints
- Termix
- Command injection
- CVSS 8.7 High
Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass
- Termix
- Command injection
- CVSS 4.6 Medium
Vim: OS Command Injection via 'path' completion
- vim
- Command injection
- CVSS 4.4 Medium
Vim: OS Command Injection in netrw
- vim
- Command injection
- CVSS 7.8 High
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
- Command injection
<3.7.9 · fixed in 3.7.9
GHSA-q4p8-8j9m-8hxj · CVE-2026-43943