Monthly
OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.
Command injection in JS Recon (js-recon) versions 1.2.1-beta.1 through 1.3.1-beta.2 lets anyone who opens a pull request run arbitrary commands on the project's GitHub Actions runner. The vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) interpolates the attacker-controlled branch name and fork repository name into a shell 'gh pr comment' command without sanitization. No public exploit is identified at time of analysis and it is not in CISA KEV, but the flaw is trivially reachable by external contributors and executes with the workflow's write-capable GITHUB_TOKEN.
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.
OS command injection in PLANET GS-4210-16P2S managed switch firmware allows a remote attacker with administrator web credentials to execute arbitrary operating-system commands on the device. The web_smtp_test_post handler in /cgi-bin/dispatcher.cgi passes a caller-supplied SMTP server field directly into a shell command without sanitization, exposing the full underlying firmware OS to the authenticated attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability compromise on successful exploitation.
Authenticated OS command injection in PLANET GS-4210-16P2S managed switch firmware prior to 3.441b260626 enables a remote administrator to execute arbitrary commands on the device operating system via a crafted certificate upload request targeting /cgi-bin/httpuploadcert.cgi. The certificate password field is incorporated into a shell command without sanitization of shell metacharacters, a textbook CWE-78 root cause. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid administrator-level web credentials, confirmed by CVSS 4.0 PR:H.
OS command injection in the PLANET GS-4210-16P2S managed PoE switch firmware before 3.441b260626 allows an authenticated remote attacker with administrative access to execute arbitrary operating-system commands on the device. The VLAN membership editing handler in /cgi-bin/dispatcher.cgi passes the memberTags POST parameter directly into a shell command without any sanitization, constituting a textbook CWE-78 flaw. No public exploit code and no CISA KEV listing are identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability impact upon successful exploitation.
Unauthenticated OS command injection in Green-Computing NUMail lets remote attackers execute arbitrary operating-system commands on the underlying mail server host. The CVSS 4.0 score of 9.3 reflects network reach with no privileges or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth access and command execution makes it a high-priority patch target.
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted `fas` query parameter to the `/opennds_preauth/` endpoint. The vulnerability originates in `libopennds.sh`, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. The fix, published in commit 8c03750, introduces strict base64-character allowlist validation that rejects any query string containing characters outside A-Za-z0-9+/=. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.
Command injection in JS Recon (js-recon) versions 1.2.1-beta.1 through 1.3.1-beta.2 lets anyone who opens a pull request run arbitrary commands on the project's GitHub Actions runner. The vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) interpolates the attacker-controlled branch name and fork repository name into a shell 'gh pr comment' command without sanitization. No public exploit is identified at time of analysis and it is not in CISA KEV, but the flaw is trivially reachable by external contributors and executes with the workflow's write-capable GITHUB_TOKEN.
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.
OS command injection in PLANET GS-4210-16P2S managed switch firmware allows a remote attacker with administrator web credentials to execute arbitrary operating-system commands on the device. The web_smtp_test_post handler in /cgi-bin/dispatcher.cgi passes a caller-supplied SMTP server field directly into a shell command without sanitization, exposing the full underlying firmware OS to the authenticated attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability compromise on successful exploitation.
Authenticated OS command injection in PLANET GS-4210-16P2S managed switch firmware prior to 3.441b260626 enables a remote administrator to execute arbitrary commands on the device operating system via a crafted certificate upload request targeting /cgi-bin/httpuploadcert.cgi. The certificate password field is incorporated into a shell command without sanitization of shell metacharacters, a textbook CWE-78 root cause. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid administrator-level web credentials, confirmed by CVSS 4.0 PR:H.
OS command injection in the PLANET GS-4210-16P2S managed PoE switch firmware before 3.441b260626 allows an authenticated remote attacker with administrative access to execute arbitrary operating-system commands on the device. The VLAN membership editing handler in /cgi-bin/dispatcher.cgi passes the memberTags POST parameter directly into a shell command without any sanitization, constituting a textbook CWE-78 flaw. No public exploit code and no CISA KEV listing are identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability impact upon successful exploitation.
Unauthenticated OS command injection in Green-Computing NUMail lets remote attackers execute arbitrary operating-system commands on the underlying mail server host. The CVSS 4.0 score of 9.3 reflects network reach with no privileges or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth access and command execution makes it a high-priority patch target.
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted `fas` query parameter to the `/opennds_preauth/` endpoint. The vulnerability originates in `libopennds.sh`, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. The fix, published in commit 8c03750, introduces strict base64-character allowlist validation that rejects any query string containing characters outside A-Za-z0-9+/=. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.