Command injection.

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

• Command injection
• Code injection

<0.9.0 · fixed in 0.9.0

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

• Command injection
• Code injection

>=4.5.87, <4.6.61 · fixed in 4.6.61

npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

• Command injection
• Broken access control

>=1.5.1, <1.7.2 · fixed in 1.7.2

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

• Command injection
• Broken access control

>=1.2.3, <1.7.2 · fixed in 1.7.2

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

• Command injection
• CWE-20

<1.6.59 · fixed in 1.6.59

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

• Command injection
• Authentication bypass

<4.6.59 · fixed in 4.6.59

PraisonAI: Compute-bridged file tools allow shell command injection

• Command injection
• Broken access control

>=4.6.10, <4.6.59 · fixed in 4.6.59

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

• Command injection
• Broken access control

>=4.5.87, <4.6.59 · fixed in 4.6.59

Docker MCP Gateway: Argument injection via OCI image label YAML

• Command injection

>=0.21.0, <0.42.2 · fixed in 0.42.2

OS Command Injection in LMS

• LMS
• Command injection

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function.

• Command injection

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function.

• Command injection

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function.

• Command injection

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python configuration function.

• Command injection

e107: Command Injection via shell expansion in ImageMagick resize destination path

• e107
• Command injection

OpenStack Horizon RC file generation does not escape special characters in project names

• Command injection

<=25.7.3 · no fixed version yet

OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit

• Splunk AI Toolkit
• Command injection

OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

• tinyhumansai OpenHuman
• Command injection
• CWE-184

OS command injection in Micro-Star International Co., Ltd. RadiX AX6600 WiFi 6 Tri-Band Gaming Router

• Micro-Star International Co., Ltd. RadiX AX6600 WiFi 6 Tri-Band Gaming Router
• Command injection

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

• Command injection
• Authentication bypass

>=1.46.0, <1.74.3 · fixed in 1.74.3

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

• Command injection

>=2021.4.11, <2026.6.9 · fixed in 2026.6.9

OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N

• TP-Link Systems Inc. TL-WR940N v6
• Command injection

OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N

• TP-Link Systems Inc. TL-WR940N v6
• Command injection

Deno: Command Injection via spawnSync & spawn on Windows

• Command injection

<2.7.10 · fixed in 2.7.10

OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector

• Radiflow iSAP Smart Collector
• Command injection

Galaxy NG: command injection vulnerability

• Command injection

<=4.9.2 · no fixed version yet

indirect remote shell command injection via unsanitized DHCP options in wicked

• SUSE wicked
• Command injection

Command injection in Dell OpenManage

• Dell OpenManage
• Command injection

Command Injection via name parameter

• TURCK TBEN-LL-SE-M2
• TURCK TBEN-L4-SE-M2
• Command injection

OS command injection in Devolutions Remote Desktop Manager

• Devolutions Remote Desktop Manager
• Command injection

BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json

• browserstack-cypress-cli
• Command injection

aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

• Command injection

<2.246.0 · fixed in 2.246.0

Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

• Fortra Core Privileged Access Manager (BoKS)
• Command injection

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

• Fortra Core Privileged Access Manager (BoKS)
• Command injection

Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection

• Yealink SIP-T46U
• Other injection
• Command injection

Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection

• Yealink SIP-T46U
• Other injection
• Command injection

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

• Command injection

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.

• Command injection

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.

• Command injection

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.

• Command injection

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.

• Command injection

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.

• Command injection

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.

• Command injection

A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.

• Command injection

Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection

• Ruijie EG105G-P
• Other injection
• Command injection

GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection

• GL.iNet GL-MT3000
• Other injection
• Command injection

GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection

• GL.iNet GL-MT3000
• Other injection
• Command injection

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle

• SHLOMIF Config::IniFiles
• Path traversal
• Command injection

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

• RURBAN GD
• Path traversal
• Command injection

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

• Command injection
• CWE-184

<2.33.8 · fixed in 2.33.8

Kitty has a shell command injection

• kovidgoyal kitty
• Command injection

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

• MariaDB server
• Command injection

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

• MariaDB server
• Command injection

MariaDB: wsrep SST unsafe parameter handling on the donor side

• MariaDB server
• Command injection

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

• MariaDB server
• Command injection

IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection

• IEI Integration Corp iVEC TANK-XM811
• Command injection

Argument injection in WebPros WordPress-Toolkit

• WebPros WordPress-Toolkit
• Command injection

ClipBucket: Remote Play URL Command Injection

• MacWarrior clipbucket-v5
• Command injection

Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command

• CyberArk Software, a Palo Alto Networks Company PAM Self-Hosted, Privilege Cloud
• Command injection

KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml

• lingdojo kana-dojo
• Command injection