Command injection.

AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection

• AidanPark openclaw-android
• Command injection

gpsd gpsprof Command Injection via gnuplot plot title subtype field

• ntpsec gpsd
• Command injection

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

• Command injection

<0.0.0-20260601075854-3356b86a8bfa · fixed in 0.0.0-20260601075854-3356b86a8bfa

Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver

• horde Vfs
• Command injection

ToolJet GitHub Actions comment body shell injection exposes deployment secrets

• ToolJet
• Command injection

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performi...

• Other injection
• Command injection

<=0.6.30 · no fixed version yet

christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection

• christopherthielen check-peer-dependencies
• Command injection

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8.

• Command injection

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8.

• Command injection

An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.…

• Command injection

An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8.

• Command injection

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

• Command injection
• Other injection

<5.1.1 · fixed in 5.1.1

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

EGroupware has Authenticated RCE via Malicious eTemplate Upload

• Command injection
• Code injection

<23.1.20260601 || >=26.0.20251208, <26.4.20260413 · fixed in 23.1.20260601, 26.4.20260413

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

• coollabsio coolify
• Command injection

Coolify: Command injection via single-quote breakout in Docker Compose custom commands

• coollabsio coolify
• Command injection

Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name

• coollabsio coolify
• Command injection

Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers

• coollabsio coolify
• Command injection

Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)

• coollabsio coolify
• Command injection

Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

• coollabsio coolify
• Command injection

Coolify: Host RCE via Sentinel token injection

• coollabsio coolify
• Command injection

Coolify: Command injection via unsanitized persistent storage name in docker volume commands

• coollabsio coolify
• Command injection

Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution

• coollabsio coolify
• Command injection

Coolify: Host RCE via Log Drain secret/env command injection

• coollabsio coolify
• Command injection

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

• coollabsio coolify
• Command injection

Coolify: Command Injection via unsanitized MongoDB collection names in database backup

• coollabsio coolify
• Command injection

Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component

• coollabsio coolify
• Command injection

Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

• coollabsio coolify
• Command injection

Coolify: Command Injection via Unescaped Version String in Docker Build

• coollabsio coolify
• Command injection

Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command

• Command injection

<5.0.0 · fixed in 5.0.0

Coolify LocalFileVolume fs_path command injection enables RCE

• coollabsio coolify
• Command injection

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

• Other injection
• Command injection

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

Coolify authenticated remote command injection leading to RCE and secret exfiltration

• coollabsio coolify
• Command injection

flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

• Command injection
• Authentication bypass

>=2.26.2, <2.26.4 · fixed in 2.26.4

Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

• Command injection

>=4.15.0, <4.18.3 · fixed in 4.18.3

react-dev-utils openBrowser permits command injection on macOS

• Command injection

<=5.0.1 · no fixed version yet

OS command injection in vesta

• vesta
• Command injection

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

Argument Injection in TUBITAK BILGEM's pardus-software

• TUBITAK BILGEM Software Technologies Research Institute pardus-software
• Command injection

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

OS command injection in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Command injection

Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments

• Command injection

<5.1.0 · fixed in 5.1.0

9router: Missing Authorization and OS Command Injection

• Command injection
• Broken access control

<0.4.44 · fixed in 0.4.44

electerm has Command Injection in File System Operations (rmrf, mv, cp)

• Command injection

<3.11.11 · fixed in 3.11.11

Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

• Command injection

<=0.132.1 · no fixed version yet

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

• Command injection

<=0.27.3 · no fixed version yet

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

• Command injection
• Information disclosure

<2026.5.18 · fixed in 2026.5.18

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

• Command injection
• Code injection

<2026.5.18 · fixed in 2026.5.18

OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

• Command injection
• Broken access control

<2026.5.12 · fixed in 2026.5.12

Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

• Notifiarr dockwatch
• Command injection
• CWE-698

obs-service-tar_scm: command injection via mercurial handler

• openSUSE buildservice
• Command injection

luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter

• openwrt luci-app-travelmate
• openwrt travelmate
• Command injection

WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter

• databasebackup WP Database Backup – Unlimited Database & Files Backup by Backup for WP
• Command injection

Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

• Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater
• Command injection

repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection

• Command injection

<1.14.1 · fixed in 1.14.1

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text_to_subtitles.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe.php

• guardian language-system
• Command injection