OS Command Injection

Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a remote attacker execute arbitrary operating-system commands by supplying crafted input in the 'url' parameter of the /test endpoint on TCP port 9002. The flaw scores CVSS 4.0 10.0 (maximum) with no authentication or user interaction required, and publicly available exploit code exists (research published by CyberDanube), though it is not yet listed in CISA KEV - no public exploit identified as actively exploited at time of analysis beyond the released POC.

Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pull request to inject shell commands into the test_dispatcher.yml GitHub Actions workflow and steal a repository-write token. Because the workflow uses the pull_request_target trigger, it executes untrusted PR-controlled data (changed filenames) in the trusted base-repository context with access to secrets. Publicly available exploit code exists (a dedicated PoC repo), though this is not listed in CISA KEV.

Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.

OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

OS command injection in Tenable Security Center (Tenable.sc) lets an authenticated attacker execute arbitrary shell commands by uploading an audit file whose filename contains shell metacharacters, which the application passes unsanitized into a system command. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.4 with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Root command injection in dracut's NetworkManager-based initrd network module allows an adjacent-network attacker to execute arbitrary code inside the initramfs during early boot. By answering a booting system's DHCP request with malicious root-path, next-server, or bootfile-name options, the attacker's payload is written unescaped into a temporary shell script and executed as root before the real OS starts. No public exploit is identified at time of analysis, and the flaw is not on CISA KEV, but a Red Hat advisory (RHSA-2026:26534) and upstream fix commit confirm the issue is real and patched.

OS command injection in the Zyxel AX7501-B1 fiber ONT/CPE allows an authenticated administrator to run arbitrary operating-system commands by injecting shell metacharacters into the "LogServer" field of the device's syslog configuration. All firmware up to and including 5.17(ABPC.7.2)C0 is affected, and successful exploitation yields full command execution on the device (CVSS 7.2, PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote arbitrary code execution in Bytebot (bytebot-ai self-hosted AI desktop agent, commit 3d37894 dated 2025-09-11) allows attackers to run OS commands by supplying a crafted path to the agent's `computer_write_file` action. The flaw is classed as OS command injection (CWE-78) and carries a CVSS 9.8, but real-world exploitation probability is currently low (EPSS 0.17%, 7th percentile) and it is not on CISA KEV. A public gist referenced by the CVE appears to document the issue and may contain proof-of-concept details, though POC status is not explicitly confirmed in the source data.

OS command injection in AVideo before version 29.0 allows remote attackers to execute arbitrary commands via the Live plugin's on_publish.php endpoint. The flaw is an incomplete fix for CVE-2026-45578: the execAsync() helper re-wraps already-escaped input inside a double-quoted 'sh -c' invocation, which lets shell command substitution using $() or backticks bypass the escapeshellarg() sanitization entirely. There is no public exploit identified at time of analysis, but the network, no-privilege, no-interaction vector (CVSS 4.0 base 9.3) makes this a high-priority patch for exposed AVideo installations.

OS command injection in GPT-SoVITS (RVC-Boss) through release 20250606v2pro lets remote unauthenticated attackers run arbitrary commands via the Gradio web UI. The webui.py helper functions for ASR, audio slicing, denoise, and UVR5 vocal separation build shell commands with shell=True and splice user-supplied path textbox values directly into them, so shell metacharacters in a path field are executed by the host. The CVSS 4.0 score is 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially triggerable against any exposed instance.

Arbitrary command execution in Roo Code (the open-source AI coding agent) through version 3.54.0 lets attackers slip past the auto-approve execute feature's allowlist/denylist by hiding command substitutions inside shell parameter-expansion defaults. Because the parser replaces parameter expansions with opaque placeholders before scanning for dangerous substitutions, a payload built from an allowlisted prefix carrying a nested $(...) is judged safe, auto-approved on the outer command, and executed by the shell via execa. A public PoC and technical write-up exist (reported by VulnCheck); there is no confirmed active exploitation (not in CISA KEV) and no EPSS score was provided.

Authenticated OS command injection in the system_certificates view lets a high-privileged remote attacker inject arbitrary operating-system commands, yielding total loss of confidentiality, integrity, and availability on the affected device. The flaw was coordinated through CERT@VDE (advisories VDE-2026-044 and VDE-2026-058), indicating an operational-technology / industrial device with a web-based management interface. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.6.

Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any external user to run arbitrary code inside the project's trusted CI context prior to firmware 2.7.21.1370b23. Because main_matrix.yml (and related workflows) triggered on pull_request_target while the check, build, and build-debian-src jobs checked out and executed code from the attacker's fork with no approval gate, a pull request from an author_association of NONE automatically ran attacker-controlled files with access to repository secrets and an elevated GITHUB_TOKEN. This is CWE-94 code injection scoring CVSS 10.0; no public exploit identified at time of analysis, though a linked Google Drive writeup may contain proof-of-concept detail.

OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.

OS command injection in Agentic-Flow (npm package ruvnet/agentic-flow) before 2.0.14 lets attacker-controlled MCP tool parameters - agent, task, name, language, and agentdb - break out of double-quoted shell arguments and run arbitrary OS commands as the MCP server user. The AI-orchestration platform's MCP server tools interpolated these values straight into strings passed to execSync(), so any untrusted content (web pages, files, third-party tool output) that the agent processes can reach the sink, and the HTTP/SSE transports expose the same sinks over the network without authentication. A working proof of concept is published in the vendor's GHSA advisory; there is no evidence of active in-the-wild exploitation (not in CISA KEV).

Remote code execution in the Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3 allows an unauthenticated remote attacker to run arbitrary commands through the exposed sbin/adbd (Android Debug Bridge daemon) component. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact, reflecting full command execution on the device. No CISA KEV listing is present and EPSS is low (0.35%, 27th percentile), but a researcher GitHub repository is referenced, indicating publicly available exploit code likely exists.

OS command injection in django-pyas2 through version 1.2.3 lets an authenticated admin plant shell commands in the Partner model's cmd_receive and cmd_send fields, which pyas2/utils.py hands directly to os.system() when an AS2 message is processed. The submitted CVSS vector rates this 9.1 (network, unauthenticated), but the description explicitly requires an authenticated admin user, so real-world exploitability is meaningfully narrower than the headline score. EPSS is low (0.64%, 47th percentile), there is no CISA KEV listing, and a third-party vulnerability-research repository is referenced that appears to document the flaw.

OS command injection in Pheditor 2.0.1 through 2.0.5 lets an authenticated user with the default-enabled `terminal` permission bypass the TERMINAL_COMMANDS allowlist and run arbitrary shell commands as the web server user. The flaw is an incomplete fix for GHSA-9643-6xjp-vx57: the sanitization blocklist added `$` but still misses the single pipe `|`, backtick, and newline (0x0A), each of which starts with a whitelisted prefix and slips past both filters. A fully working exploit is published in the GHSA advisory, and because Pheditor ships with the default password `admin`, the required authentication is frequently trivial to obtain, effectively lowering the barrier to unauthenticated RCE.

Authenticated command-injection in Pheditor 2.0.4 lets any user holding the 'terminal' permission bypass the TERMINAL_COMMANDS allowlist and run arbitrary OS commands as the web server user. The terminal handler only blocks '&', ';', and '||' and validates commands with a prefix check before handing the full string to shell_exec(), so shell substitution like ls$(...) satisfies the allowlist while executing attacker-controlled code. A working PoC is published in the GitHub advisory, though there is no public exploit identified as a standalone weaponized tool and no active exploitation reported.

PowerShell command injection in Lenovo XClarity Integrator for Microsoft Windows Admin Center (versions 5.1.1 and below) running on the WAC Gateway allows an authenticated low-privileged attacker to inject arbitrary PowerShell commands when the plugin establishes remote PowerShell sessions. Successful exploitation yields high-impact code execution that extends beyond the plugin into subsequent systems (managed hosts), with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the install command that Kiota presents to developers. When a developer runs `kiota info` (or the VS Code extension's `kiota info --json` dependency-install flow) against an attacker-controlled spec, Kiota reads the `x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand` field plus attacker-chosen dependency name/version values and surfaces them as its trusted recommended install command, achieving arbitrary command execution when that command is run. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the fix explicitly removes the untrusted extension field.

OS command injection in WWBN AVideo through version 29.0 allows attackers to execute arbitrary operating-system commands as the web-server user via the ffmpeg.json.php endpoint. The notifyCode and callback request parameters are concatenated into a shell command without escaping, so an attacker able to produce a valid encrypted payload can inject shell metacharacters and achieve remote code execution. No public exploit identified at time of analysis; the flaw carries a CVSS 4.0 base score of 9.2, though successful exploitation is gated by the requirement to forge a valid encrypted payload.

OS command injection in AVideo (WWBN) through version 29.0 lets remote attackers who can forge a valid encrypted codeToExec payload run arbitrary shell commands as the web-server user via the listFFmpegProcesses() function in the standAlone plugin API. The flaw is unauthenticated (PR:N) but non-trivial to reach because it depends on producing an accepted encrypted parameter, and no public exploit or CISA KEV listing is identified at time of analysis.

OS command injection in the systeminformation Node.js library (npm, versions <= 5.31.6) lets an attacker who can influence a `source`d path in Debian/Ubuntu `interfaces(5)` files run arbitrary shell commands with the privileges of any process that calls `networkInterfaces()`. The unsanitized path token parsed from `/etc/network/interfaces` (and files it recursively sources) is interpolated into a `cat ... | grep` shell string executed via `execSync()`, so metacharacters in the path break out and execute commands. Publicly available exploit code exists (working PoC in the advisory); no public exploit is identified as being used in active exploitation. Fixed in 5.31.7.

OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user execute arbitrary commands on the server by uploading an avatar with shell metacharacters in its filename. The user-supplied filename is embedded into a shell string passed to child_process.exec() for MIME-type detection in models/avatars.js and models/fileValidation.js, so backticks or $() in the name run as server-side commands. No public exploit is identified at time of analysis, but the vendor commit and advisory confirm the flaw; it is fixed in v9.07.

GitHub Actions expression injection in MaaAssistantArknights' dev-v2 CI (release-preparation.yml) lets an external attacker execute arbitrary shell commands on the ubuntu-latest runner by opening a non-draft fork pull request whose title begins with 'Release v'. The attacker-controlled pull_request.title was inlined directly into a run: block during opened, reopened, and ready_for_review events, so a crafted title breaks out of the sed command in the generate-changelog job. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the class is trivially weaponizable and the fix commit (cafc3946) is public. EPSS was not provided.

Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the host by chaining a Host-header spoof (to reach routes that are supposed to be localhost-only) with unsanitized MCP plugin arguments that flow into child_process.spawn() via the /api/mcp//sse endpoint. Rated CVSS 8.8 (CWE-78, OS command injection), it is fixed in 0.5.2; no public exploit or CISA KEV listing exists at time of analysis, though a vendor advisory and fix commit are published.

OS command injection in AWS jsii-diff before 1.131.0 lets a context-dependent attacker execute arbitrary shell commands when a victim runs the tool against an attacker-controlled 'npm:' source specifier. The npm package-loading component fails to sanitize the package specifier before passing it to a shell, so a crafted specifier is interpreted as a command. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor-released patch (v1.131.0) is available.

Authenticated remote code execution in LangBot (pip package 'langbot', versions <= 4.10.5) allows any logged-in user to run arbitrary OS commands on the host by registering a malicious 'STDIO' MCP server through the Extensions > MCP configuration UI. Because LangBot passes the user-supplied command straight to the MCP SDK's StdioServerParameters, which spawns it as a subprocess, an attacker who signs up or uses stolen credentials gains full host takeover. A step-by-step and video proof-of-concept is public (publicly available exploit code exists), though there is no confirmed active exploitation.

Command injection in Tabby (formerly Terminus) terminal emulator before 1.0.234 lets an attacker achieve code execution by tricking a victim into dragging and dropping a crafted file whose path contains shell command-substitution metacharacters ($(...) or backticks). Because the drop handler in tabby-electron/src/pathDrop.ts inserted the raw path into the active shell without neutralizing these characters, the payload runs when the victim presses Enter. This is an incomplete-fix follow-up to CVE-2026-45038, which only addressed control characters; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

OS command execution in PraisonAI before 4.6.78 lets an attacker who can supply a workflow definition escape the inline-Python sandbox and run arbitrary shell commands with the privileges of the agent process. The flaw lives in JobWorkflowExecutor._exec_inline_python(), whose AST-based validation fails to reject `import os` followed by `os.system()`, turning a malicious YAML workflow file into RCE. No public exploit code or CISA KEV listing is identified at time of analysis, though the bypass technique is described in detail in the vendor advisory.

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitrary `command` and `args` values in the server-creation JSON, which LiteLLM passes to the host OS without validation, yielding remote code execution as the LiteLLM process. The flaw is part of the broader MCP-stdio supply-chain advisory disclosed by ox.security across the AI ecosystem and is documented in LiteLLM's own April 2026 advisory. No public exploit is identified in the provided data, and EPSS is low (0.32%, 24th percentile), so widespread automated exploitation is not currently indicated despite the CVSS 9.8 rating.

Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current user via an OS command injection flaw (CWE-78) triggered when a victim opens a maliciously crafted file. The scope-changed CVSS 3.1 score of 8.2 reflects that successful exploitation can affect resources beyond the vulnerable application. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the primary risk gate is social-engineering the victim into opening a hostile document.

Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the current user when a victim opens a maliciously crafted file. The flaw is an OS command injection (CWE-78) with no public exploit identified at time of analysis and no active exploitation reported in CISA KEV; risk hinges on social-engineering a user into opening the file. Adobe published fixes in advisory APSB26-83.

Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege access inject and run arbitrary commands over the network, yielding full confidentiality, integrity, and availability compromise (CVSS 8.8). Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Command injection in Outlook Copilot (Microsoft Copilot) lets an authenticated, low-privileged attacker inject unneutralized special elements over the network to tamper with the service, with Microsoft's CVSS rating a high confidentiality impact alongside limited integrity impact. The flaw was reported and fixed by Microsoft (MSRC CVE-2026-55145) and carries a CVSS 3.1 base score of 7.1. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none.

Local privilege escalation in the Windows Clipboard User Service lets an already-authenticated low-privileged user run OS commands in the service's higher-privilege security context by injecting special elements into a command the service constructs (CWE-77). Affected platforms are Windows 11 24H2/25H2 and Windows Server 2025 (including Server Core). Microsoft has issued a patch; there is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.

Local privilege escalation in Microsoft Windows Narrator (the built-in screen reader) arises from improper neutralization of special elements in its Braille support component, allowing an already-authenticated local attacker (PR:L) to inject and execute OS commands that run with elevated privileges. All supported Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025 are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so exploitation is not confirmed as active.

Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker run arbitrary commands on the host with the privileges of the editor. Reported by Microsoft with a vendor patch available, the CVSS 3.1 score of 8.4 reflects full compromise of confidentiality, integrity, and availability via a local attack vector requiring no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in the Microsoft 365 Copilot mobile apps for Android and iOS lets an unauthenticated attacker run code across a security boundary by getting a user to interact with crafted content (CWE-77 command injection). The CVSS 9.6 rating reflects network reach, low complexity, no privileges, and a changed scope with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, but a vendor patch is available and the flaw was self-reported by Microsoft.

OS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell metacharacters through the domain name parameter of an HTTP management interface, yielding arbitrary command execution as root and full device takeover. The flaw scores CVSS 4.0 8.5 (High) and a vendor firmware patch is available; no public exploit identified at time of analysis. Note a naming discrepancy in the source data - the free-text description says 'VX800v' while the CPE and tags reference 'VX1800V' - so verify the exact affected model against the TP-Link advisory before acting.

Root-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an attacker who controls (or has compromised) the ACS provisioning server inject unsanitized parameters that the device executes as system-level commands. Because CWMP provisioning is trusted implicitly, a malicious or hijacked ACS can push crafted values that yield arbitrary command execution as root and full device takeover. No public exploit identified at time of analysis, and the flaw was reported by TP-Link itself; a firmware fix is available.

Remote command injection in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets unauthenticated or CSRF-driven attackers store a malicious payload via the optional cli_control plugin's HTTP endpoint and execute arbitrary OS commands on the host when the linked irrigation station is activated. Because the plugin ships with no passphrase protection or the well-known default passphrase 'opendoor', exploitation is trivial on default installs. Publicly available exploit code exists (ZeroScience/VulnCheck), though the flaw is not listed in CISA KEV, and the CVSS 4.0 base score is 9.2 (Critical).

OS command injection in Apache Kylin (versions 4 through 5.0.3) allows attackers to execute arbitrary operating-system commands by supplying malicious job configuration parameters that a backend API passes unsanitized to the OS command line. Because Kylin runs as a distributed analytics engine, successful exploitation yields full host compromise with the privileges of the Kylin service account. Per the vendor CVSS (AV:N/PR:N), the flaw is scored as network-reachable and unauthenticated with high impact across confidentiality, integrity, and availability; no public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Remote OS command execution in Vitec Flamingo 4.12.2 lets unauthenticated attackers run arbitrary commands as root through the admin/ajax/gen_graphs.php graph-generation endpoint. The start, end, key, and format GET parameters are passed unsanitized into a PHP passthru() shell call, and because the web server runs with passwordless sudo the impact escalates to full root compromise. Publicly available exploit code exists (VulnCheck), though there is no CISA KEV listing, so this is a high-priority, easily weaponizable flaw.

Unauthenticated OS command injection in Vitec Flamingo 4.12.2 (IPTV distribution) lets remote attackers run arbitrary commands as root through the admin/ajax/ping.php endpoint. The flaw stems from a double-evaluation bug where a system wrapper re-uses the decoded, un-escaped host value in a second shell call executed via passwordless sudo. Publicly available exploit code exists (VulnCheck); no active exploitation is confirmed in CISA KEV at time of analysis.

Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-system commands via the 'NPC start' endpoint exposed on the device's web server at TCP port 8090. Reported by DIVD (Dutch Institute for Vulnerability Disclosure), the flaw carries a CVSS 4.0 base score of 9.3 with a fully network-exploitable vector (AV:N/PR:N/UI:N) and high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; no EPSS score was supplied.

OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arbitrary commands as root by tampering with the data value of the vendor-specific `ReserveLogin` DataTransfer message. The flaw was reported by DIVD (Dutch Institute for Vulnerability Disclosure) and affects the charger's OCPP handling; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because execution occurs as root, successful exploitation results in full compromise of the charging station.

Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network diagnosis endpoint exposed on the web server at TCP port 8090. Because the CVSS 4.0 vector specifies no privileges and no user interaction (AV:N/PR:N/UI:N), a remote unauthenticated attacker who can reach port 8090 can inject operating-system commands and fully compromise the device. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the DIVD coordinated disclosure and 9.3 (Critical) score make it a high-priority defect.

OS command injection in the Comfast CF-WR631AX V3 WiFi router (firmware through 2.7.0.8) lets remote attackers execute arbitrary operating-system commands by manipulating the filename argument in the system_wl_upload_pic_file routine of the /usr/bin/webmgnt FastCGI backend. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation, and publicly available exploit code exists (E:P). It is not listed in CISA KEV, so there is no confirmed active exploitation, but the public disclosure lowers the barrier for opportunistic attacks against exposed devices.

Command injection in the TRENDnet TEW-635BRM wireless router (firmware through 1.00.03) lets an authenticated remote attacker inject OS commands via the ipoa_ipaddr argument handled by the ipoa_test function in /sbin/rc during IPoA WAN connection setup. Publicly available exploit code exists (published via VulDB and a researcher write-up), and because the device runs its control logic as a privileged system process, successful injection yields full command execution on the router. The product has been end-of-life since 2011 and the vendor will not issue a fix, so exposure is permanent for still-deployed units; there is no CISA KEV listing or confirmation of active exploitation.

OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated user achieve arbitrary command execution on the host by importing a crafted .tool file that declares an MCP stdio transport and triggering it through an AI Chat node. Because the tool-import path (apps/tools/serializers/tool.py) and the MCP referencing path (base_chat_step.py) fail to consistently validate the MCP transport type, the MultiServerMCPClient spawns the attacker's stdio command locally. Rated CVSS 8.8; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Command execution allowlist bypass in PraisonAI before 4.6.78 lets a low-privileged attacker who can supply commands to the framework's restricted-execution feature slip past its shell-metacharacter filters by abusing find's built-in -exec, -execdir, and -delete actions. Because those actions run binaries and delete files entirely inside the find process, they never trip the metacharacter allowlist, so the attacker can read blocked files, delete arbitrary files, and launch non-allowlisted binaries. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 8.7 (High) reflects full loss of confidentiality, integrity, and availability of the affected system.

Root-level OS command execution in Dell PowerFlex Manager (versions prior to 5.1.0.1) lets a remote, high-privileged attacker inject operating-system commands during OS Repository processing, resulting in full appliance compromise. Because PowerFlex Manager orchestrates storage and HCI infrastructure, code execution as root also enables lateral movement into managed nodes. There is no public exploit identified at time of analysis, and Dell has released a fixed build (5.1.0.1) via advisory DSA-2026-066.

OS command injection as root in the R-SOFT DMS Optical Character Recognition (OCR) module lets an authenticated attacker run arbitrary shell commands. Multiple OCR command-execution functions accept user-controllable file paths and pass them unsanitized to the system shell over SSH, yielding full root-level compromise of the document management server. No public exploit has been identified at time of analysis, and the flaw is mitigated in the default web-upload flow because URL encoding neutralizes the injection, which is reflected in the high attack complexity (AC:H).

OS command injection in R-SOFT DMS lets an authenticated user run arbitrary shell commands as the web server account by abusing the document converter. The konwertujAction() routine builds shell commands from unsanitized file-path and format parameters (CWE-78), so any user who can trigger a conversion can inject commands. Discovery is credited to CERT Polska; no public exploit identified at time of analysis and it is not listed in CISA KEV. CVSS 4.0 base is 8.7 (High).

OS command injection in the wnx/laravel-backup-restore Composer package (fixed in v1.9.4) allows an attacker who can get a malicious backup archive restored to run arbitrary shell commands as the Laravel application user. The restore workflow interpolates an unescaped ZIP entry filename from the db-dumps directory directly into shell command strings (mysql, psql, sqlite3, gunzip) executed via Symfony Process::fromShellCommandline(), so shell metacharacters in the filename are interpreted by /bin/sh. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially exploitable once a crafted archive reaches the restore path.

Authenticated command injection in Coolify (self-hosted PaaS) before 4.0.0-beta.469 allows a logged-in user to run arbitrary shell commands inside deployment containers by supplying malicious health-check parameters. The generate_healthcheck_commands() routine in ApplicationDeploymentJob.php interpolates the health_check_host, health_check_method, and health_check_path values straight into a shell command line, so any user able to configure an application's health check gains OS command execution during deployment. No public exploit identified at time of analysis, but the upstream fix and advisory (GHSA-4fhp-xqqp-w7vv) publicly document the vulnerable code path.

Unauthenticated remote code execution in Ruflo (an agent meta-harness for Claude Code and Codex) before 3.16.3 arises because the default docker-compose deployment exposes the MCP bridge's POST /mcp and POST /mcp/:group endpoints with no authentication. A network attacker can send a JSON-RPC tools/call to the terminal_execute tool to gain an interactive shell inside the bridge container, exfiltrate provider API keys, and tamper with AgentDB learning-store patterns. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis, and it is not in CISA KEV.

Command injection in self-hosted Hoppscotch instances prior to 2026.6.0 allows an authenticated administrator to achieve root-level code execution in the backend container. The updateInfraConfigs GraphQL mutation accepts an attacker-controlled MAILER_SMTP_URL whose path, query, or fragment is parsed by nodemailer into sendmail transport options, turning SMTP configuration into arbitrary command execution once the service restarts and sends mail. No public exploit identified at time of analysis, but the flaw is confirmed and patched upstream in release 2026.6.0.

Remote code execution in Discourse (via the discourse-ai plugin's PDF-to-text feature) allows an attacker who can upload a crafted PDF to run arbitrary commands on the server, but only in non-default configurations where an LLM vision model is configured. The flaw is a CWE-78 OS command injection reached when uploaded PDFs are rasterized through ImageMagick, which in turn invokes an external delegate (Ghostscript) on attacker-controlled input. It is not in CISA KEV and has no public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile), and vendor patches exist across all supported release lines.

Arbitrary shell command execution in gpsd's gpsprof profiling tool (through release-3.27.5) allows an attacker who controls a GPS device's subtype value to run commands as the user rendering the plot. The subtype string - taken from a DEVICES JSON log entry or an NMEA PGRMT sentence - is embedded into a generated gnuplot program's `set title` statement with only double quotes escaped, so backtick payloads execute when the victim renders the plot via the gpsprof/gnuplot workflow. This was reported by VulnCheck; a vendor fix is available (fixed at commit 4c06658), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Arbitrary command execution on operator workstations in Cloud Foundry BOSH CLI before 7.10.5 allows a compromised or malicious BOSH Director to inject and run shell commands locally when an operator invokes bosh ssh, bosh scp, or bosh logs -f with default flags. Because the CLI trusts director-supplied data and passes it into a shell, a controlled director turns a routine operator action into local code execution on the trusted management host. No public exploit identified at time of analysis; not listed in CISA KEV, though the reference blog by Cloud Foundry (originally reported by VMware) confirms the flaw and a fixed release.

Remote code execution in Nuclio's Kubernetes cron-trigger implementation allows an attacker who can submit a NuclioFunction specification to inject arbitrary shell commands that execute inside CronJob pods running as root. Two unsanitized paths exist: header keys are interpolated verbatim inside double-quoted shell arguments (breaking quoting context), and event bodies processed with Go's strconv.Quote survive as unescaped `$()` command substitution sequences. Both paths were dynamically verified on the latest release (1.15.27), and the resulting CronJobs persist as orphaned resources even after function deletion because they carry no ownerReferences. A publicly available PoC with full reproduction steps exists per the GHSA advisory. No KEV listing at time of analysis.

OS command injection in the Horde_Vfs_Smb driver of the Horde Virtual File System (VFS) API before 3.0.1 lets authenticated users execute arbitrary shell commands on the server. The flawed _escapeShellCommand() method fails to neutralize shell command-substitution sequences, so attacker-controlled filenames passed through routine file operations are interpolated into a double-quoted /bin/sh -c context and executed via proc_open() before smbclient runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch (v3.0.1) exists and the CVSS 4.0 base score is 7.7 (High).

OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject arbitrary shell commands through the unsanitized machine_name configuration parameter, gaining root-level code execution on the device. The flaw lives in the start_lltd() function of the 'rc' binary and requires valid high-privilege credentials (CVSS 7.2, PR:H). Publicly available exploit code exists via a third-party IoT vulnerability write-up, but there is no confirmation of active exploitation and the EPSS probability is low (0.96%).

Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject shell commands through the unsanitized lan_ipv6_prefixlen configuration parameter, which reaches the vulnerable sub_34984() routine in the 'rc' binary. Because injected commands run as root, an admin-level attacker gains full control of the device operating system. Publicly available exploit code exists (SSVC 'poc' plus a GitHub write-up), but there is no public evidence of active exploitation and EPSS is low at 0.96% (57th percentile).

Root-level OS command injection in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) small-business routers lets an authenticated remote attacker run arbitrary commands via the unsanitized model_name parameter in the httpd binary's save_syslog_to_file() function. Because injected commands run as root, successful exploitation yields full device takeover. Publicly available exploit code exists (SSVC exploitation status: poc) but the flaw is not listed in CISA KEV.

Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated remote administrator inject arbitrary shell commands through the wan_hostname parameter, which is passed unsanitized into the start_bonjour() routine of the 'rc' binary. Because the 'rc' process runs as root, successful exploitation yields full command execution and complete device takeover. Publicly available exploit details exist in an IoT vulnerability write-up; there is no evidence of active exploitation (not in CISA KEV) and no EPSS score was provided.

CI/CD pipeline injection in ToolJet's GitHub Actions render-preview deployment workflow (versions prior to 3.20.180) allows any GitHub user who can comment on an open pull request to execute arbitrary shell commands on the CI runner and exfiltrate deployment secrets. The root cause is direct interpolation of `github.event.comment.body` - a fully attacker-controlled input - into a bash conditional `run:` step without sanitization. A proof-of-concept has been documented (SSVC: poc), the vendor has released a fix in 3.20.180, and the attack is not listed in CISA KEV at time of analysis.

Remote unauthenticated OS command injection in 9Router before 0.4.44 lets attackers run arbitrary commands as root via the POST /api/tunnel/tailscale-install endpoint, which is excluded from the dashboard authorization middleware. The attacker-supplied sudoPassword field is piped to the stdin of a 'sudo -S sh' child process; when sudo does not prompt for a password, sh interprets that value as a shell command. Active exploitation evidence was reported by the Shadowserver Foundation on 2026-07-04; this is not (yet) listed in CISA KEV, and no public exploit code is referenced in the supplied data.

OS command injection in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus the LTS2026, LTS2025, and LTS2024 branches) lets an already-authenticated, high-privileged remote user break out of the appliance's restricted management context and run arbitrary commands as root. Dell rates it Critical because the flaw defeats the platform's protection mechanism and yields full root-level code execution on the backup appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Dell explicitly urges customers to upgrade at the earliest opportunity.

Authenticated OS command injection in EGroupware lets an admin-level user escalate from web access to arbitrary shell command execution as the web server user (typically www-data). By uploading a crafted eTemplate .xet file to the admin-only /etemplates VFS mount, an attacker abuses Widget::expand_name(), which feeds widget attribute values into a PHP eval() while escaping only double quotes and leaving backtick shell operators intact. Publicly available exploit code exists and a vendor patch is available; there is no CISA KEV listing, so this is not confirmed as actively exploited.

OS command injection in Coolify, the open-source self-hostable server/application/database management PaaS, allows an authenticated user with permission to edit application settings (versions prior to 4.0.0-beta.469) to run arbitrary commands on the managed host. The flaw lives in the executeInDocker() helper, which wraps user-controlled values in single quotes without escaping embedded quotes, letting an attacker break out of the quoted shell context during deployments and escape the intended Docker container confinement. No public exploit identified at time of analysis; this is not listed in CISA KEV.

OS command injection in Coolify's self-hosted server/app management platform lets an authenticated user achieve remote code execution on the underlying host via a malicious database import container name. The database import Livewire component passes client-controlled container and server properties into shell commands without locking or validation, so any low-privileged authenticated user can inject arbitrary commands. Rated CVSS 8.8 and fixed in 4.0.0-beta.471; no public exploit identified at time of analysis and it is not listed in CISA KEV.

OS command injection in Coolify (self-hosted server/application/database management platform) versions prior to 4.0.0-beta.471 allows an authenticated low-privileged member to run arbitrary commands as root on managed servers by embedding shell metacharacters in persistent volume names, which are interpolated unescaped into shell commands during volume operations. The CVSS 3.1 score is 8.8 (High) with a network vector requiring only low privileges. No public exploit identified at time of analysis; an upstream fix commit and a tagged patched release exist.

Command injection in Coolify before 4.0.0-beta.471 lets an authenticated user break out of the pre-deployment and post-deployment command fields and run arbitrary shell statements on the target deployment server. The supplied commands are single-quote escaped but then piped through an SSH heredoc transport that preserves newlines, so newline-delimited injected statements survive escaping and execute during deployment. No public exploit is identified at time of analysis, though the fixing pull request and commit are public and make the root cause easy to reconstruct; CVSS is 8.8 (High).

Authenticated command injection in Coolify (self-hosted server/application/database management platform) before 4.0.0-beta.466 lets a user with access to a server's Sentinel settings embed shell metacharacters in the sentinel_token value, which is passed unsanitized into a shell command and executed on the host the next time Sentinel is restarted (CWE-78). The flaw yields full host command execution with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor has released a fixed build (v4.0.0-beta.466) with an available upstream commit.

OS command injection in Coolify (self-hosted server/app management platform) before 4.0.0-beta.471 lets an authenticated user embed shell metacharacters in a LocalPersistentVolume storage name, which is interpolated unescaped into docker volume shell commands and executed on managed servers when the associated resource is deleted. Rated CVSS 8.8 (CWE-78), it yields arbitrary command execution on downstream hosts controlled by the Coolify instance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix is confirmed in release 4.0.0-beta.471.

OS command injection in Coolify's self-hosted server-management platform (all versions prior to 4.0.0-beta.471) lets any authenticated team member execute arbitrary shell commands on any managed remote server. The flaw lives in the Livewire Server\Resources component, whose public startUnmanaged/stopUnmanaged/restartUnmanaged methods take a browser-supplied container ID and interpolate it unescaped into SSH-executed shell commands. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivially low complexity (CVSS 8.8) makes exploitation straightforward for anyone with a team account.

OS command injection in Coolify (self-hosted server/application/database management platform) before 4.0.0-beta.466 lets an authenticated user execute arbitrary commands on the host by supplying log drain secret or environment values that are interpolated into shell commands without proper encoding. Because Coolify orchestrates the underlying host, the injected commands run with the platform's host-level context, effectively yielding host takeover. No public exploit identified at time of analysis; this is not in CISA KEV and no POC is referenced, so risk is driven by the ease of authenticated exploitation rather than confirmed in-the-wild activity.

Command injection in Coolify self-hosted PaaS versions prior to 4.0.0-beta.474 allows an authenticated user to run arbitrary OS commands inside the PostgreSQL database container by supplying malicious postgres_user or postgres_db values that are interpolated into shell-form healthcheck commands (CWE-78). Because the CVSS vector is PR:L/UI:N with full high impact to confidentiality, integrity, and availability, any user able to create or configure a database can achieve container-level code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation to root command execution in Coolify (self-hosted PaaS) prior to 4.0.0-beta.471 lets any authenticated user holding the lowest-privilege team 'member' role run arbitrary OS commands as root on every server Coolify manages. The flaw lives in the GetLogs Livewire component, whose $container public property is unsanitized and lacks the #[Locked] attribute, so any team member can tamper with it over the Livewire wire protocol. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the low authentication barrier and full CIA impact make it high priority for any multi-tenant Coolify deployment.

OS command injection in Coolify (self-hosted server/app/database management platform) versions 4.0.0-beta.471 through 4.0.0-beta.473 lets an authenticated team member run arbitrary shell commands on the underlying host. A regression weakened the SHELL_SAFE_COMMAND_PATTERN allowlist so that ampersands were permitted in custom Docker Compose build, start, and pre/post-deployment command fields, enabling command chaining. The issue is fixed in 4.0.0-beta.474; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local privilege escalation in Linuxfabrik Monitoring Plugins (and the underlying linuxfabrik-lib Python library) lets an attacker who already controls the low-privileged nagios account execute arbitrary OS commands, typically as root. The flaw stems from the library's shell_exec() helper splitting assembled command strings on the pipe (|) character, so user-controlled plugin arguments such as restic-check's --repo can inject additional commands. Publicly available exploit code exists (a PoC is included in the vendor advisory), but the issue is not listed in CISA KEV and no EPSS score was provided.

Authenticated command injection in Coolify (self-hostable PaaS) before 4.0.0-beta.471 lets any user with rights to add file storage execute arbitrary OS commands on the host. The LocalFileVolume::saveStorageOnServer routine assembles shell commands from user-controlled fs_path and parent_dir values without escaping, and submitFileStorage never validates the file-mount path before volume creation, so injected shell metacharacters run when the storage is saved. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; risk stems from the low bar (PR:L) and full-compromise impact.

Remote command injection in Coolify (self-hosted PaaS) before 4.0.0-beta.469 lets an authenticated user with application write permissions inject OS commands through deployment-handling fields such as dockerfile_location, achieving arbitrary code execution on the deployment host and exfiltrating secrets via deployment logs. The flaw scores CVSS 9.9 because command injection breaks out of the application context to compromise the underlying server (scope change), exposing environment variables and other applications' secrets. No public exploit has been identified at time of analysis, but the fix is available in tagged release v4.0.0-beta.469.

Unauthenticated OS command execution in flyto-core (Python package, confirmed on 2.26.2) allows any client that can reach the HTTP MCP endpoint (POST /mcp) to run arbitrary shell commands as the server process. The JSON-RPC tools/call handler lacks the require_auth dependency present on the equivalent REST route, so an attacker can invoke execute_module against sandbox.execute_shell and reach asyncio.create_subprocess_shell with attacker-controlled input. Publicly available exploit code exists (a curl one-liner and poc.py in the advisory); there is no CISA KEV listing and no EPSS score provided, and by default the server binds to 127.0.0.1, making this a local (CVSS 8.4) issue that becomes network-exploitable only when started with --host 0.0.0.0.

Argument injection and directory traversal in Apache Camel's camel-docling component (4.15.0 before 4.18.3) let attackers who can influence the CamelDoclingCustomArguments or path-bearing exchange headers inject unintended docling CLI flags and traversal-laden path values into the externally executed docling tool. Because the original DoclingProducer validation relied on a flag denylist and only rejected literal '../' sequences, crafted arguments could reach the subprocess and resolve files outside the intended directory, yielding high confidentiality and integrity impact but no OS command injection (ProcessBuilder uses the list form, so no shell interprets the values). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; EPSS is low (0.79%, 52nd percentile).