Command Injection

OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.

Command injection in JS Recon (js-recon) versions 1.2.1-beta.1 through 1.3.1-beta.2 lets anyone who opens a pull request run arbitrary commands on the project's GitHub Actions runner. The vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) interpolates the attacker-controlled branch name and fork repository name into a shell 'gh pr comment' command without sanitization. No public exploit is identified at time of analysis and it is not in CISA KEV, but the flaw is trivially reachable by external contributors and executes with the workflow's write-capable GITHUB_TOKEN.

Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.

Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.

OS command injection in PLANET GS-4210-16P2S managed switch firmware allows a remote attacker with administrator web credentials to execute arbitrary operating-system commands on the device. The web_smtp_test_post handler in /cgi-bin/dispatcher.cgi passes a caller-supplied SMTP server field directly into a shell command without sanitization, exposing the full underlying firmware OS to the authenticated attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability compromise on successful exploitation.

Authenticated OS command injection in PLANET GS-4210-16P2S managed switch firmware prior to 3.441b260626 enables a remote administrator to execute arbitrary commands on the device operating system via a crafted certificate upload request targeting /cgi-bin/httpuploadcert.cgi. The certificate password field is incorporated into a shell command without sanitization of shell metacharacters, a textbook CWE-78 root cause. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid administrator-level web credentials, confirmed by CVSS 4.0 PR:H.

OS command injection in the PLANET GS-4210-16P2S managed PoE switch firmware before 3.441b260626 allows an authenticated remote attacker with administrative access to execute arbitrary operating-system commands on the device. The VLAN membership editing handler in /cgi-bin/dispatcher.cgi passes the memberTags POST parameter directly into a shell command without any sanitization, constituting a textbook CWE-78 flaw. No public exploit code and no CISA KEV listing are identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability impact upon successful exploitation.

Unauthenticated OS command injection in Green-Computing NUMail lets remote attackers execute arbitrary operating-system commands on the underlying mail server host. The CVSS 4.0 score of 9.3 reflects network reach with no privileges or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth access and command execution makes it a high-priority patch target.

OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.

Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted `fas` query parameter to the `/opennds_preauth/` endpoint. The vulnerability originates in `libopennds.sh`, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. The fix, published in commit 8c03750, introduces strict base64-character allowlist validation that rejects any query string containing characters outside A-Za-z0-9+/=. No public exploit code or CISA KEV listing has been identified at time of analysis.

Command injection in oPanel's advanced/curl component allows authenticated attackers to execute arbitrary shell commands on the underlying server. The 'url' parameter accepted by the built-in curl tool is not sanitized, enabling shell metacharacter injection by any logged-in user. A public proof-of-concept is available at the linked GitHub repository, and SSVC rates the technical impact as total, meaning full system compromise is achievable post-authentication.

OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.

OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.

OS command injection in ZoneMinder's event export functionality enables any authenticated user holding the View Events permission to execute arbitrary commands on the underlying server. The exportFile HTTP request parameter is passed without sanitization into PHP's exec() function, granting attackers full control over server-side command execution. Reported by ICS-CERT under ICSA-26-237-02 and tracked in GitHub Security Advisory GHSA-88m4-hrgp-m9v3, the flaw carries a CVSS 4.0 score of 8.7 across all current ZoneMinder versions, with no public exploit identified at time of analysis.

Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs and prints a CLI invocation using untrusted metadata fields (such as pepper_name) without shell-quoting. An attacker who controls the metadata of an encrypted file can embed shell commands that run on the victim's system the moment the printed CLI block is copied and pasted into a terminal. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk hinges on the victim copy-pasting attacker-influenced output.

OS command injection in maquina-app rails-mcp-server versions 1.4.0 through 1.6.0 allows any caller with access to the execute_ruby MCP tool to escape the purported Ruby sandbox and execute arbitrary shell commands as the server process owner. The execute_ruby tool's denylist blocked Kernel#system, exec, and backtick invocations but never covered Ruby's pseudo-terminal library (PTY) entry points - PTY.spawn and PTY.getpty - enabling a caller to require 'pty' and spawn a child process entirely outside the guarded method replacements. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the bypass path is fully documented in the vendor's public patch PR.

OS command injection in Liman server management software (limanmys/core) before version 2.2.2 - 1103 lets an authenticated administrator run arbitrary operating-system commands on the host via the log rotation configuration endpoint. The unsanitized `ip_address` parameter is concatenated into a shell command, allowing single-quote shell-escape to break out and execute attacker-controlled commands. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in 2.2.2 - 1103.

OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. A public proof-of-concept exists (GitHub issue #40), and a vendor-released patch (v3.10.3) is available.

Remote unauthenticated command execution affects a broad range of Zbtlink MT7620-based routers and gateways (WE1326, WE2426-C, WE5926 family, WE826 family, WG108/WG3526, WF3526-P, CTN720-W1, LF-1541, MT7620N, WRC1) whose infosrvd service listens on UDP/9992. A single crafted UDP packet lets an attacker run arbitrary commands as root, because the service's authentication relies on a hardcoded salt and accepts an all-zero wildcard MAC, defeating the intended check. Publicly available exploit code exists (research and advisory published by VulnCheck), the CVSS 4.0 base score is 9.3, and no active exploitation has been confirmed in CISA KEV at time of analysis.

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An attacker can exploit this vulnerability by injecting specially crafted shell metacharacters or payloads into the vulnerable parameter, resulting in the execution of arbitrary operating system commands.

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An attacker can exploit this vulnerability by injecting specially crafted shell metacharacters or payloads into the vulnerable parameter, resulting in the execution of arbitrary operating system commands.

OS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged authenticated users. The CWE-78 root cause indicates that user-controlled input is passed unsanitized to OS-level shell commands exposed through a network-accessible interface. Dell confirmed this in advisory DSA-2026-369; no public exploit or CISA KEV listing has been identified at time of analysis, though the full C:H/I:H/A:H impact profile makes this a high priority for any organization running this data protection platform.

OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to execute arbitrary operating system commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a valid low-privileged credential, with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.

OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a security advisory (DSA-2026-353) addressing the issue.

OS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote user smuggle special shell characters into a command the product executes on the underlying host, resulting in arbitrary command execution. Dell rates it CVSS 9.1 with a scope change, meaning the injected commands can escape the application's authorization boundary onto the host OS. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so severity is driven by impact rather than confirmed activity.

Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Command injection in the Ubiquiti UniFi Enterprise Audio/Video Bridge allows a network-adjacent attacker to run arbitrary operating-system commands on the device by supplying maliciously crafted input that the firmware fails to validate. The CVSS 3.1 base score is 9.8 and the vector marks the flaw as network-reachable with no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch.

Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV, but the 9.9 severity and low attack complexity make it a top-priority patch.

Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Command injection in Ubiquiti's UID Enterprise Agent lets a high-privileged, network-adjacent actor run arbitrary OS commands on the host device by supplying improperly validated input. The flaw carries a CVSS 9.1 rating driven by a scope change and full compromise of confidentiality, integrity, and availability, though exploitation requires existing high privileges (PR:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability to execute arbitrary operating-system commands on the underlying host, per Ubiquiti Security Advisory Bulletin 067. The flaw stems from improper input validation (CWE-20) and, with a scope-changed CVSS 9.1, lets a compromised or malicious privileged account break out of the application context to fully control the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the network-reachable management interface to break out of the application and run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a vendor-assigned CVSS of 9.1, driven largely by a scope change from application to host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the only source is Ubiquiti's own Security Advisory Bulletin 067.

Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR.

Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network gear) allows an attacker holding high-privilege access on the network to inject and execute operating-system commands on an adopted device managed by the controller. Because the injected command runs on a downstream device rather than the controller itself, the flaw crosses a trust boundary (CVSS scope change) and yields full confidentiality, integrity, and availability impact on the target device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.

Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execute arbitrary OS commands on the underlying host server. Covering all tracked versions per CPE cpe:2.3:a:librenms:librenms:*, this CWE-78 flaw was disclosed by PRJBLK alongside a publicly available proof-of-concept exploit targeting version 26.5.0. No CISA KEV listing was identified at time of analysis, but the public PoC materially lowers the exploitation bar for any attacker who already holds admin credentials.

Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated.

OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. A vendor patch exists (commit 36e7c6c), it was reported by VulnCheck, and no public exploit has been identified at time of analysis.

OS command injection in zackees/transcribe-anything (versions up to 4.1.0) allows remote attackers to execute arbitrary system commands by supplying a crafted URL argument to the `ytdlp_download` function in `src/transcribe_anything/ytldp_download.py`. The CVSS 4.0 score is 2.9 - low - primarily because attack complexity is rated High, meaning exploitation requires specific conditions to align rather than trivial one-shot delivery. A publicly available proof-of-concept exploit exists via GitHub issue #137, and the vendor has not responded to the coordinated disclosure, leaving no patch available at time of analysis.

Argument injection in the Okta Privileged Access client allows a crafted SSH target username beginning with a hyphen to be interpreted as a command-line option by the underlying SSH subprocess. Organizations using Okta Privileged Access for SSH session brokering are affected when a user initiates a connection to a target whose username has been set to a hyphen-prefixed value. If exploited, an attacker who can influence the target username definition could cause the SSH client to process injected options, achieving high confidentiality impact. No public exploit code is identified at time of analysis, and CISA KEV does not list this CVE.

OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.

OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to execute arbitrary operating system commands with the privileges of the targeted process. All versions of NemoClaw are indicated as affected per NVD CPE data (wildcard version range). Successful exploitation can result in full code execution, persistent data tampering, sensitive information disclosure, and denial of service on the host. No public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. All versions of NemoClaw appear affected per the CPE wildcard (*), and the vulnerability is rooted in improper neutralization of user-supplied input passed to shell commands (CWE-78). No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting current real-world risk primarily to environments with untrusted local users.

OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privileged access to execute arbitrary operating system commands. Exploitation yields full confidentiality, integrity, and availability compromise on the affected host, with potential for privilege escalation beyond the invoking user. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and minimal privilege requirement (PR:L) lower the practical bar for exploitation once local access is obtained.

OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.

Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.

Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.

Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority.

OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands, achieving code execution in the context of the current user with a scope change that extends impact beyond the vulnerable component. Adobe (the reporting vendor) rates this maximum severity CVSS 10.0 (CWE-78), and exploitation requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a vendor-disclosed, not-yet-actively-exploited critical flaw.

Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.

Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.

Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.

Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-network authenticated users to execute arbitrary commands on the UFM host by submitting a specially crafted API request. All current release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per vendor-supplied CPE data. Successful exploitation yields code execution, privilege escalation, and information disclosure on a platform that controls InfiniBand fabric infrastructure, amplifying downstream impact on managed HPC and AI compute clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unrestricted OS command execution in mcp-shell prior to v0.6.0 allows any LLM connected via stdio to invoke the shell_exec tool with arbitrary command strings, running them as the mcp-shell process user with no filtering, allowlisting, or logging. The root cause is that config.go initializes SecurityConfig.Enabled to false and SecurityValidator.validateCommand unconditionally short-circuits when that flag is false, bypassing all CWE-78-class protections. Both the from-source installation path and the MCP client configuration example in the README omit MCP_SHELL_SEC_CONFIG_FILE, making every operator who follows the documented instructions unknowingly vulnerable. No CISA KEV listing or independent public exploit repository has been identified at time of analysis; a vendor-confirmed fix is available in v0.6.0.

Arbitrary OS command execution in mcp-shell's default Docker image allows any MCP tool caller to bypass the secure-mode executable allowlist by supplying `/bin/bash -c <payload>` to the `shell_exec` tool, running commands as `mcpuser` (UID 1000) inside the container. The validator in `security.go` extracts only the first whitespace-delimited token as the executable, approves `/bin/bash` against the default allowlist, and passes the `-c` flag through the metacharacter check unchallenged because the default `blocked_patterns` array is empty. A fully working PoC is included in the GitHub Security Advisory GHSA-3x77-wg38-92r3; no public exploit identified at time of analysis beyond the researcher-provided PoC, and no CISA KEV listing exists. Vendor-released patch v0.6.0 is confirmed.

OS command injection in mcp-shell's 'secure mode' allows any MCP client to execute arbitrary shell commands by exploiting Git's runtime alias mechanism. The security validator in security.go blocks common shell metacharacters but omits '!', the prefix Git uses to invoke shell aliases via '-c alias.NAME=!CMD'. Because /usr/bin/git is in the default allowed_executables list and the CVSS PR:N vector confirms no authentication is required, all default Docker deployments (mcpuser, UID 1000, Git pre-installed) are exploitable by any entity with MCP connectivity. A fully functional PoC is published in the GHSA advisory; no CISA KEV listing is present at time of analysis.

OS command injection in FishCodeTech Muteki up to version 0.2.5 enables remote low-privileged attackers to execute arbitrary operating system commands through unsanitized input handled by the Default Local Worker Backend component, specifically via the application's .claude/settings.json configuration file. Publicly available exploit code (POC) exists, referenced from a dedicated exploit report repository, raising the practical exploitability despite the product's limited deployment footprint. The project maintainer closed the issue without a patch, announcing that Muteki will be refactored and shut down, making this effectively an unpatched, end-of-life vulnerability with no vendor remediation path. No public exploit identified at time of analysis as confirmed active exploitation by CISA KEV.

Remote code execution in Weidmueller IE-SR-2TX-WL industrial security routers allows an unauthenticated network attacker to run arbitrary OS commands as root via the web management interface. The modified uhttpd server passes the HTTP Basic Authentication username directly into a shell command, so a crafted username containing shell metacharacters yields full device compromise. No public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3 (Critical).

OS command injection in sworddut mcp-ffmpeg-helper affects the handleToolCall function in src/tools/handlers.ts across all three released versions (0.1.0, 0.1.1, 0.2.1), allowing a local low-privilege attacker to execute arbitrary OS commands by manipulating the format argument. Publicly available exploit code exists via a GitHub issue, and the vendor has not responded to the coordinated disclosure, leaving all known versions unpatched. This is not listed in CISA KEV; exploitation requires local access, which substantially limits real-world exposure.

Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis.

Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available.

Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.

Command injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary OS commands with root privileges by supplying crafted username or password values. At least ten VigorSwitch models are confirmed affected via CPE data, with the full tag list extending coverage to approximately 28 model variants. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability class (CWE-78) and the root-level impact make it high priority for any DrayTek VigorSwitch deployment where administrative credentials may be compromised or shared.

Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute arbitrary OS commands with root privileges. At least 28 VigorSwitch models across DrayTek's managed switch lineup are affected, spanning both Gigabit and PoE/fiber variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability once administrative access is leveraged.

Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS commands with root privileges across at least ten confirmed models, with tags suggesting up to 28 additional affected variants. The flaw stems from insufficient input sanitization of username and password fields before shell execution, a classic CWE-78 pattern. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is gated behind valid administrative credentials, per the CVSS PR:H rating and vendor description.

Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS commands with root privileges through the setDevProto function's unsanitized username and password fields. At least 10 CPE-confirmed models are affected, with vendor tags suggesting a broader footprint of approximately 28 VigorSwitch variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, DrayTek published a security advisory in August 2026 acknowledging the vulnerability and the authentication prerequisite of valid admin credentials is the primary constraint on real-world exploitation.

Command injection in DrayTek VigorSwitch firmware's fdftDevice function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted input in the username or password fields of the web management interface. Approximately 28 VigorSwitch models across the G, P, Q, and PQ series are affected, confirmed by both VulnCheck reporting and a DrayTek vendor advisory published August 2026. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Command injection in DrayTek VigorSwitch's rebDevice function allows authenticated remote attackers with valid administrative credentials to execute arbitrary OS commands with root privileges by submitting crafted username or password values through the web management interface. At least 10 VigorSwitch models are confirmed affected per CPE data, with tags suggesting coverage across roughly 28 distinct models spanning the G, P, Q, PQ, and FX product lines. No public exploit or CISA KEV listing has been identified at time of analysis, though the advisory originates from a VulnCheck disclosure coordinated with a DrayTek security bulletin dated August 2026.

Command injection via the setDevice function affects multiple DrayTek VigorSwitch managed switch models, allowing an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying unsanitized input in the username, password, or location fields. The breadth of affected hardware - at least 28 distinct VigorSwitch SKUs spanning G, P, PQ, Q, and FX series - substantially widens the organizational exposure surface. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible management interface and high-impact outcome make this a meaningful post-compromise escalation path.

Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers holding valid administrative credentials to execute arbitrary OS commands with root privileges. The flaw (CWE-78) arises from the web management interface failing to sanitize username and password fields before incorporating them into system command execution. DrayTek published a security advisory in August 2026 covering a broad range of VigorSwitch models; no public exploit code or CISA KEV listing has been identified at time of analysis.

Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted values in the username or password fields of the web management interface. At least 28 VigorSwitch models across the G, P, Q, PQ, and FX series are confirmed affected by the DrayTek August 2026 security advisory and VulnCheck reporting. No public exploit code has been identified at time of analysis, but the breadth of affected models and full root-level impact make this a patch-priority item for any organization operating DrayTek managed switching infrastructure.

Command injection in DrayTek VigorSwitch managed switches allows an authenticated remote attacker holding administrative credentials to execute arbitrary OS commands with root privileges by supplying crafted input to the auth_set function via the web management interface. At least 28 distinct VigorSwitch model lines are affected across DrayTek's G, P, PQ, Q, and FX series, with the vulnerability reported by VulnCheck and acknowledged via a DrayTek security advisory in August 2026. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis; the CVSS 4.0 score of 8.6 with PR:H accurately reflects that valid administrative credentials are a prerequisite, materially limiting opportunistic mass exploitation.

Pre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker run arbitrary commands as root by supplying crafted input to the setget.cgi 'pass' field, which is passed to a shell without sufficient filtering. The flaw affects a broad range of VigorSwitch models (G/P/Q-series including G2540Xs, P2282X, Q2300X, G2542X and ~30 listed variants) and carries a CVSS 4.0 score of 9.3. No public exploit has been identified at time of analysis, but DrayTek has published a security advisory addressing it.

Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to execute arbitrary OS commands with root privileges via the web management interface. The flaw resides in the sysreboot function, which fails to sanitize the config, act, pathN, and valueN parameters before passing them to OS command execution, per CWE-78. No public exploit or CISA KEV listing exists at time of analysis, but the VulnCheck and DrayTek advisories confirm the vulnerability across at least 28 VigorSwitch SKUs.

Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute arbitrary OS commands with root privileges across more than 25 managed switch models. Insufficient input sanitization of the `option`, `key`, `pw_encode`, `pathN`, and `valueN` parameters enables shell metacharacter injection, resulting in full device compromise. No public exploit has been identified at time of analysis; the administrative credential prerequisite is the primary barrier against opportunistic exploitation.

Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator to execute arbitrary OS commands with root privileges by submitting a crafted host field value. Twenty-eight distinct VigorSwitch models across the G, P, Q, PQ, FX, and PX series are affected, with patched firmware releases varying by model family (2.9.10, 2.10.6, 2.10.7, and 3.10.6). No public exploit has been identified at time of analysis and CISA has not listed this in KEV; exploitation is constrained by the mandatory administrative credential requirement confirmed by the CVSS PR:H metric.

Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple firmware branches, allowing an authenticated administrator to execute arbitrary OS commands with root privileges on the device. The root cause is incomplete sanitization of shell metacharacters - specifically backticks, newline characters, and single quotes - in a parameter field processed by the web management interface. Exploitation requires valid administrative credentials; patch available per DrayTek's August 2026 security advisory. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arbitrary OS commands as root by submitting crafted values in the usescript, usefile, or option fields. At least 28 distinct VigorSwitch models across multiple firmware branches are confirmed affected per EUVD-2026-64974 and vendor advisory. Vendor-released patches are available; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. It was reported by VulnCheck, a vendor patch is available, and no public exploit has been identified at time of analysis.

Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via a crafted restorekey parameter in the upload_settings.cgi endpoint. Six VigorAP hardware models share the vulnerable codebase: 903, 906, 912C, 918R, 960C, and 1060C. Vendor firmware patches are available for all affected models; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands with root privileges. Six CPE-confirmed models across the VigorAP 903, 906, 912C, 918R, 960C, and 1060C series are affected in all firmware versions below their respective patch thresholds. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available and should be applied promptly given the root-level impact.

Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authenticated remote attacker to execute arbitrary OS commands with root privileges by submitting crafted input to the InquierTime function's time field via the web management interface. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - the time parameter is passed to a system shell without adequate filtering, enabling shell metacharacter injection. No public exploit identified at time of analysis; a vendor-released patch is available across all affected model lines.

Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbitrary OS commands with root privileges across six VigorAP models. The vulnerability exists in the mesh_start_speed_test function, where unsanitized meshdevice_index and meshdevice_ip input is passed directly to shell command execution, yielding complete device compromise including full confidentiality, integrity, and availability impact. Vendor-released patches are available for all affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.

Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute arbitrary OS commands with root privileges by submitting crafted input to the setcamset function via the web management interface. Six distinct VigorAP models are confirmed affected across multiple firmware branches, each with a separate patch target version released in August 2026. No public exploit identified at time of analysis, but the network-accessible attack vector and root-level impact make this a high priority for organizations with internet-exposed VigorAP management interfaces.

Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands as root by submitting malicious input to the setLan function's lanIp or lanNetmask parameters. Six models spanning several firmware lines are confirmed affected, with vendor patches now available for all of them per the August 2026 DrayTek security advisory. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the root-level code execution outcome warrants prompt firmware upgrade wherever management interfaces are network-reachable.