Advisories · Weakness
Command injection.
Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.8 Medium
OS command injection in NVIDIA OpenShell
- NVIDIA OpenShell
- Command injection
- CVSS 7.8 High
OS command injection in NVIDIA NemoClaw
- NVIDIA NemoClaw
- Command injection
- CVSS 7.8 High
OS command injection in NVIDIA NemoClaw
- NVIDIA NemoClaw
- Command injection
- CVSS 7.8 High
OS command injection in NVIDIA NemoClaw
- NVIDIA NemoClaw
- Command injection
- CVSS 7.8 High
OS command injection in NVIDIA NemoClaw
- NVIDIA NemoClaw
- Command injection
- CVSS 8.8 High
OS command injection in NVIDIA OpenShell
- NVIDIA OpenShell
- Command injection
- CVSS 5.3 Medium
Improper Validation of SSH Target in Okta Privileged Access Client
- Okta Privileged Access Client
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
- Command injection
>=2.4.0rc0, <2.12.0 · fixed in 2.12.0
GHSA-w3fx-mc44-mf6j · CVE-2026-45018 - CVSS 9.8 Critical
Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
- Command injection
<=3.10.2 · no fixed version yet
GHSA-3h2g-j4wp-7qqq - CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe Campaign Classic
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe Campaign Classic
- Command injection
- CVSS 7.8 High
Emacs: emacs: command injection via crafted filenames in tramp
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Command injection
- CVSS 6.8 Medium
Command injection in NVIDIA Unified Fabric Manager Enterprise - GA and others
- NVIDIA Unified Fabric Manager Enterprise - GA
- NVIDIA Unified Fabric Manager Enterprise - LTS 2025
- Command injection
- CVSS 6.8 Medium
Command injection in NVIDIA Unified Fabric Manager Enterprise - GA and others
- NVIDIA Unified Fabric Manager Enterprise - GA
- NVIDIA Unified Fabric Manager Enterprise - LTS 2025
- Command injection
- CVSS 8.0 High
Command injection in NVIDIA Unified Fabric Manager Enterprise - GA and others
- NVIDIA Unified Fabric Manager Enterprise - GA
- NVIDIA Unified Fabric Manager Enterprise - LTS 2025
- Command injection
- CVSS 8.6 High
mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist
- Command injection
<0.6.0 · fixed in 0.6.0
GHSA-f5pj-2738-996m · CVE-2026-55580 - CVSS 8.4 High
mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
- Command injection
- CWE-183
<0.6.0 · fixed in 0.6.0
GHSA-3x77-wg38-92r3 · CVE-2026-55581 - CVSS 8.4 High
mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias
- Command injection
<0.6.0 · fixed in 0.6.0
GHSA-74hp-mggr-hv58 · CVE-2026-55582 - CVSS 5.3 Medium
FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
- FishCodeTech Muteki
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
- Weidmueller Interface IE-SR-2TX-WL
- Weidmueller Interface IE-SR-2TX-WL-4G-EU
- Command injection
- CVSS 6.9 Medium
Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection
- Fdawgs node-poppler
- Other injection
- Command injection
- CVSS 6.5 Medium
Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
- Command injection
<=3.1.58 · no fixed version yet
GHSA-89ff-m8wv-p99r - CVSS 9.8 Critical
Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
- Command injection
<=3.1.58 · no fixed version yet
GHSA-9557-234j-7rv9 - CVSS 4.8 Medium
sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection
- sworddut mcp-ffmpeg-helper
- Command injection
- CVSS 8.5 High
Command Injection in Parent Control of TP-Link Archer BE3600 v1
- TP-Link Systems Inc. Archer BE3600 v1
- Command injection
- CVSS 8.5 High
Command Injection Vulnerability in VPN connection of Archer BE800
- TP-Link Systems Inc. Archer BE800 v1
- Command injection
- CVSS 8.7 High
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
- TP-Link Systems Inc. Archer BE800 V1
- TP-Link Systems Inc. Archer BE3600 V1
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via setTime
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via getVid
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 8.6 High
DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via apautotest
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via InquierTime
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via setcamset
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via setLan
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 8.6 High
DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 7.5 High
OS command injection in Black Duck blackduck-c-cpp
- Black Duck blackduck-c-cpp
- Command injection
- CVSS 8.4 High
OS command injection in Sakura Editor
- Sakura Editor
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection
- 4MOSAn Security Technology 4MOSAn GCB Doctor
- Command injection
- CVSS 2.0 Low
TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
- TanStack devtools-vite
- Command injection
- CVSS 8.1 High
D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.
- Command injection
- CVSS 5.3 Medium
Tenda CH22 exeCommand formexeCommand command injection
- Tenda CH22
- Other injection
- Command injection
- CVSS 5.3 Medium
Tenda CH22 editFileName formeditFileName command injection
- Tenda CH22
- Other injection
- Command injection
- CVSS 8.5 High
hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection
- hashcat
- Command injection