OS Command Injection

Unauthenticated OS command injection in TOZED X300 devices up to firmware version 6.01.3 allows remote attackers to execute arbitrary operating system commands by supplying shell metacharacters in the Host argument of the IP Ping Diagnostics feature, which is typically exposed through the device's web management interface. All severity signals converge on maximum risk: the vulnerability scores 10.0 under CVSS 4.0 with high impact to confidentiality, integrity, and availability, and the vendor did not respond to disclosure and has not released a patch. Exploitation is limited primarily by whether the diagnostics interface is reachable from the attacker's network, as it is often bound to a LAN or administrative VLAN rather than the WAN; no public exploit identified at time of analysis.

OS command injection in the open-source OpenSpug Spug operations platform (affected versions through 3.4.0 and 4.0.1) allows an authenticated, low-privileged remote user to execute arbitrary operating-system commands on the host by sending crafted input to the /exec/transfer endpoint of the File Transfer component. Exploitation is low-complexity and requires no user interaction, but it does require a valid session against the Spug web interface (CVSS PR:L), so exposure is limited to attackers who already hold a low-privileged account rather than anonymous internet users. Publicly available exploit code exists (published rating E:P) and there is no CISA KEV entry indicating confirmed active exploitation, while the vendor was contacted and did not respond, leaving no vendor-released patch identified at time of analysis.

Command execution in Spotweb through 1.5.8 can be triggered through the optional runcommand NZB handler when malicious Usenet spots carry shell metacharacters in their titles; a Spotweb user then has to download the spot so the unescaped title is substituted into $SPOTTITLE and passed to exec(). Exploitation does not require Spotweb authentication, but it is conditional on the runcommand handler being enabled and on passive victim interaction, and code runs with the privileges of the Spotweb PHP process. Publicly available exploit code exists, though no CISA KEV active exploitation is reported; instances without the runcommand integration are not exposed through this path.

OS command injection in FusionPBX through 5.6.5 lets unauthenticated attackers inject shell metacharacters into the SIP Caller-ID name or number, which are written into recording filenames when the non-default record_name filename template is enabled, so that arbitrary commands execute as the web-server user once a privileged user exports multiple recordings as a ZIP. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) rates this 7.7, reflecting network reachability with high attack complexity and mandatory privileged-user interaction rather than an easily weaponized flaw; our independent assessment maps to CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation requires the attacker to place calls carrying crafted Caller-ID values and then wait for an authenticated administrator to trigger the ZIP download; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing).

OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.

Command injection in the Argo CD repo-server allows anyone holding repository create/update privileges to execute arbitrary shell commands on the repo-server by configuring an SSH Git repository with a proxy URL whose hostname contains shell metacharacters. The flaw affects all Argo CD releases from v2.11.0 onward (v2.10.20 and earlier are not vulnerable) and carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires delegated repository or repository-credential-template write access (PR:L), not anonymous access, and no user interaction is needed once the malicious proxy is stored. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in v3.3.15, v3.4.10, v3.5.4, and v3.6.0-rc2.

OS command injection in IBM Guardium Data Protection 12.2.2 and 12.1 lets a remote attacker execute arbitrary operating-system commands with the privileges of the vulnerable service, yielding a full compromise of confidentiality, integrity, and availability (CVSS 9.8, CWE-78). The CVSS vector rates the flaw as unauthenticated (PR:N) over the network (AV:N) with no user interaction, although IBM's own text does not confirm whether a valid console or API session is needed to reach the vulnerable command path, and the practical risk is narrowed by the fact that Guardium appliances are normally deployed on internal management networks rather than being internet-facing. As of analysis, there is no public exploit code identified, EPSS is low at 0.36% (28th percentile), CISA SSVC records Exploitation: none with Automatable: no, and there is no KEV listing, so the dominant driver of urgency is the severity of impact if an attacker does obtain a path to the interface rather than observed exploitation.

Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skyeye service account on Windows. The flaw resides in the TTS textToSpeech endpoint, where the 'format' parameter is concatenated into a PowerShell string without sanitization; a single quote can break out and run attacker-supplied commands. Exploitation requires the instance to be running on Windows and the endpoint to be network-reachable, but no authentication or user interaction is needed, making default deployments a high-priority target. No public exploit code or confirmed active exploitation was identified at time of analysis.

Command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user execute arbitrary operating-system commands as SYSTEM on the primary domain controller emulator (PDCe). Both the vendor CVSS 4.0 vector (9.4) and our independent CVSS 3.1 assessment agree on PR:L with UI:N and changed scope, meaning an attacker who already holds a valid low-privileged tenant account needs no user interaction and faces low attack complexity to pivot from tenant access to domain-controller-level code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact is severe and the barrier of entry is only an existing credential, so this should be treated as a high-priority remediation.

Local privilege escalation in IBM Guardium Data Protection 12.2 lets an already-authenticated, high-privileged user gain root-level command execution by feeding attacker-controlled arguments to the SUID-root ssh_config_wrapper component. Because the component runs with effective UID 0, successful argument injection converts a privileged-but-limited foothold into full root control of the appliance, with high impact to confidentiality, integrity, and availability. This is a moderate-severity escalation issue rather than a remote-takeover emergency: the attacker must already hold a high-privileged account and be able to invoke the vulnerable binary locally, and no public exploit code has been identified at time of analysis. A vendor patch is available, though the specific fixed build is not enumerated in the supplied data.

Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.

OS command injection in the image_optimizer Ruby gem versions 1.3.0 through 1.9.0 allows unauthenticated remote attackers to execute arbitrary shell commands with the privileges of the Ruby process by supplying an image path containing shell metacharacters such as ';'. The flaw is reachable only when the consuming application enables the 'identify' option (so that ImageOptimizer#identify_format runs) and the attacker controls the image path argument, typically through an attacker-chosen uploaded file name, which means real-world impact is bounded by the OS privileges of the Ruby/web worker process and by whether user-controlled filenames reach the gem. The CVSS 4.0 base score of 9.3 reflects high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis; the included gist and VulnCheck advisory serve as the primary public technical disclosures.

OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.

OS command injection in the ppt2png Node.js library (through version 0.0.6) lets attackers run arbitrary operating system commands by embedding shell metacharacters such as ';' in the input or output path arguments that the library concatenates into a child_process.exec() call in ppt2png.js. The vulnerable code is only reachable when a consuming application forwards attacker-controllable data into those path parameters; exploitation is therefore conditional on the embedding application, but when reachable the injected commands execute with the full privileges of the Node.js process, and no authentication is required per the assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, CVSS 4.0 base 9.3). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the near-maximum severity and trivial injection technique make prompt remediation or strict path sanitization critical for any deployment that exposes these parameters.

OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.

Unauthenticated remote OS command injection in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices lets any attacker who can reach the device's web management interface run arbitrary operating-system commands with root privileges by supplying shell metacharacters through the CLI parameter. Rated CVSS 9.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication, no user interaction, and no non-default configuration, giving a full compromise of the device's confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a GitHub proof-of-concept that lands a root shell, so exploitation is straightforward for anyone with network reachability; no CISA KEV entry or confirmed in-the-wild exploitation was present in the available data, and the practical limiting factor is exposure - devices whose management plane is confined to the ISP access network or an isolated LAN are protected by segmentation rather than by any authentication control.

Unauthenticated remote command execution in Openfind SecuShare Pro allows attackers to inject and execute arbitrary operating system commands on the server, as described in CVE-2026-107459 (CVSS 9.3, CWE-78). The flaw affects default internet-exposed deployments that are reachable over the network, and no public exploit has been identified at time of analysis. Successful exploitation grants full control over the affected system, enabling data theft, malware installation, or lateral movement.

OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.

Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.

OS command injection in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated, low-privilege administrative user with adjacent-network access to the management plane to break out of the restricted management environment and execute arbitrary shell commands with elevated privileges by supplying a crafted timezone string to the time and zone management subsystem via the REST API or configuration download routines. No user interaction is required, and the reporter scores it 8.6 under CVSS 4.0, while our independent assessment concurs on high confidentiality, integrity, and availability impact under AV:A/AC:L/PR:L/UI:N/S:U. There is no public exploit identified at time of analysis and no confirmed active exploitation; because valid management credentials and adjacency to the switch management network are both mandatory, this is a credible elevated-priority issue rather than an emergency.

Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).

Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.

Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.

OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).

Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).

Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.

Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.

Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. The issue is fixed in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4, is rated CVSS 7.7 with high attack complexity, low privileges, and scope change, and there is no public exploit identified at time of analysis.

Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.

Command injection in h-ui v0.0.25 and earlier allows an authenticated administrator to execute arbitrary OS commands as root by supplying shell metacharacters in the 'listen' configuration field of the administrative API. Because the application builds nftables/iptables rule strings with fmt.Sprintf and runs them through bash -c with root privileges, a successful injection yields full host compromise with high confidentiality, integrity, and availability impact. Exploitation requires valid administrative credentials plus the ability to set the listen field, so realistic risk concentrates on multi-operator or weakly-secured panels; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch has been identified.

Post-authentication OS command injection in SonicWall SMA1000 firmware (12.5.0-02952 and 12.4.3-03526 platform-hotfixes and older) allows an attacker with administrator credentials to execute arbitrary OS commands, leading to remote code execution. The independent assessment rates this as a moderate priority due to the requirement for valid administrator credentials and undisclosed 'specific conditions'; no public exploit code has been identified at time of analysis. The vendor CVSS vector (AV:L) differs from the assessed network vector, and exploitability may be further limited by configuration-specific factors.

Command injection in GitAhead 2.7.1 and earlier on macOS allows an attacker to execute arbitrary shell commands as the victim user by placing a crafted filename containing a double quote and AppleScript payload into a repository and convincing the victim to select 'Show in Finder' on that file. The flaw requires user interaction (the victim must open an attacker-controlled repository and explicitly trigger the action) and affects only macOS; no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 score is 8.7 with a vector indicating network attack, no privileges required, and passive user interaction.

OS command injection in GitAhead through 2.7.1 lets a malicious repository execute arbitrary shell commands on the victim's machine during a routine checkout or staging operation, because crafted filenames are substituted unescaped into Git clean/smudge filter commands that GitAhead runs through 'bash -c'. The attack is remote and unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but high in complexity and gated on user interaction: the victim must clone or open an untrusted repository and then perform a checkout or stage, making it a conditional code-execution risk rather than a mass-exploitation event. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though the 7.7 base score and full confidentiality/integrity/availability impact justify prompt attention for anyone using the client with repositories of uncertain provenance.

OS command injection in patool's Windows argument-quoting routine lets a crafted archive filename (for example report&calc.gz) break out of quoting and run arbitrary commands through cmd.exe with the privileges of the patool process. All patool releases before 4.0.6 are affected, but only when patool runs on a Windows host and processes an attacker-supplied archive; the vulnerable path is the single-file-format extraction flow that invokes the shell, and exploitation requires the victim to actively run patool against the malicious file (passive user interaction). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score of 8.5 (High) reflects total confidentiality, integrity and availability impact within the local execution context, tempered by the Windows-only, user-assisted attack preconditions. Authentication is not required to trigger the flaw (CVSS 4.0 vector PR:N).

OS command injection in Rundeck before 6.2.0 allows an authenticated user who holds job-run permission to execute arbitrary commands on Windows target nodes by injecting cmd.exe metacharacters (such as &&, |, >, and ;) into free-text job option values. The flaw is in CLIUtils.quoteWindowsCMDArg, which wraps arguments in single quotes - characters that have no quoting semantics in cmd.exe - so the injected command is interpreted rather than treated as literal text, and it executes with the privileges of the node executor's credentials. Exploitation requires a valid account with job-run authorization, a job that targets Windows nodes through the cmd.exe-based executor, and a job definition that exposes a free-text option passed as a command argument; there is no public exploit identified at time of analysis, and the independent assessment rates this a moderate-priority authenticated RCE rather than a drive-by critical issue.

Operating system command injection in BugTracker.NET's SVN integration lets an authenticated administrator store malicious arguments in the repository configuration field, which are later concatenated into an svn.exe command line and executed when the revision-comparison feature is invoked, yielding arbitrary command execution under the application service account's privileges. Exploitation requires a high-privileged (administrator) account, the optional SVN integration to be enabled, and svn.exe to be installed and invokable by the service account (AT:P in the vendor CVSS 4.0 vector), so the realistic attack surface is narrow despite the network vector. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; the reported CVSS score is 7.5, though our independent assessment rates the practical risk lower given the layered prerequisites.

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the service execute arbitrary operating system commands on the underlying host. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no credentials, no user interaction, and no non-default configuration, so a default Langflow deployment exposed beyond localhost is directly exploitable. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); IBM has published a vendor advisory with a fix, and practical risk is concentrated in self-hosted developer instances that are bound to reachable interfaces rather than being restricted to localhost or placed behind authentication and firewalling.

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any holder of valid credentials - even a low-privileged one - submit or edit a flow that reaches the server-side code-generation and execution path, resulting in arbitrary OS command execution on the Langflow backend. IBM scores it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and classifies the root cause as CWE-94 code injection; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so active exploitation is not confirmed. The decisive risk factor is deployment posture: internet-exposed or multi-tenant instances running with authentication disabled, default or shared credentials, or open self-registration collapse the PR:L barrier and behave like unauthenticated RCE targets.

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows an authenticated attacker to run arbitrary operating-system commands by supplying crafted input to a component that fails to neutralize special elements before passing them to an OS command or code-evaluation path (CWE-94). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires a valid low-privilege authenticated session on the Langflow instance, needs no victim interaction, and yields full confidentiality, integrity, and availability impact on the affected host. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the practical risk is concentrated on network-exposed Langflow servers that use weak, shared, or default credentials, since a compromised or low-privilege account is the only prerequisite.

Command injection in the ClearPass Policy Manager API allows an authenticated remote attacker holding only low-privilege credentials to execute arbitrary commands and escalate to administrative control of the affected appliance, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is network-reachable and requires no user interaction, but it is not exploitable by a fully unauthenticated attacker - valid low-privilege API access is a hard precondition. At time of analysis there is no public exploit identified, and no evidence of active exploitation (no CISA KEV listing); the risk is rated high-priority for organizations running the product but not an emergency absent exploitation signals.

Command injection in the client software component of HPE Aruba ClearPass Policy Manager allows an attacker to execute arbitrary commands with elevated privileges on an affected host, provided they can get crafted input into the client's processing path. The flaw is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): it is network-reachable, low complexity, and requires no authentication, but exploitation depends on a user or operator of the client interacting with attacker-supplied input (UI:R), which is the principal limiting factor - the appliance/server is not compromised by an unsolicited remote request alone. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; no EPSS score was provided in the source data, so exploitation likelihood should be judged primarily on the user-interaction prerequisite and the elevated-privilege impact if triggered.

Unauthenticated SQL injection in HPE Aruba Networking ClearPass Policy Manager allows a remote attacker who can reach the affected interface to inject arbitrary SQL into the application's database layer, with successful exploitation enabling execution of arbitrary database commands. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and the confidentiality, integrity, and availability impact is total; any ClearPass instance whose management/web service is reachable from an untrusted network is directly at risk. No public exploit code has been identified at time of analysis and the flaw is not in CISA's KEV catalog, but the pre-authentication, network-reachable profile and the database-command execution outcome make this a high-priority item for exposure reduction and patching per the HPE advisory.

OS command injection in Arista CloudVision CUE backup management allows an authenticated Super User to execute arbitrary commands with the privileges of the affected service by submitting a crafted backup request. Exploitation is access-gated: it requires the highest application privilege level (PR:H), so anonymous or low-privileged remote users cannot trigger it; the issue functions as an application-admin-to-OS escalation. No public exploit identified at time of analysis, and no EPSS score or KEV status was provided; the independent assessment characterizes this as a genuine but access-gated vulnerability rather than a mass-exploitation threat.

OS command injection in Dell OpenManage Integration for Microsoft Windows Admin Center (versions prior to 3.7.0) allows an authenticated low-privileged remote attacker to execute arbitrary commands on the management host, compromising confidentiality, integrity, and availability. The vulnerability requires network access (AV:N) and low privileges (PR:L) but no user interaction (UI:N), and it is only reachable where the Dell OpenManage Integration extension is installed. No public exploit code or active exploitation is currently identified; the vendor has released a security advisory (DSA-2026-442) with a fix in version 3.7.0.

Authenticated low-privileged users of Microsoft SimpleChat can achieve operating-system command execution under the application service identity by exploiting an authorization-ordering flaw in POST /api/user/plugins (CVE-2026-105797, CVSS 8.8). Affected releases are 0.261.003 and 0.261.027; an attacker with a valid low-privilege session can omit the top-level MCP type field so that the _reject_non_admin_mcp_stdio check skips inspection, after which the type is restored from metadata and a stdio MCP action is persisted - the process then spawns when that action tool is invoked. Exploitation additionally requires two non-default deployment prerequisites (personal plugins enabled and governance permitting MCP actions), and there is no public exploit identified at time of analysis; vendor-released patch: 0.261.031.

OS command injection in SambaBox appliances running versions before 5.4.1 allows an attacker who holds a valid but low-privileged account to execute arbitrary operating system commands on the underlying host by supplying shell metacharacters to a command-handling function. The flaw is network-reachable, low-complexity, and requires no user interaction, but the need for an authenticated session (CVSS PR:L) is the key limiting factor that separates it from a fully unauthenticated remote code execution scenario. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in organizations that actually expose SambaBox interfaces to users beyond a trusted management network.

Authenticated command injection in Microsoft UFO's Mobile MCP server (ufo/client/mcp/http_servers/mobile_mcp_server.py) lets a caller holding a valid Mobile MCP API key smuggle shell metacharacters through the type_text text parameter and the launch_app package_name parameter; the adb client concatenates those values into a remote command string that the connected Android device re-parses, executing extra commands as the Android shell user. The issue affects UFO releases prior to 3.0.10 and, per the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector (8.8), requires authentication (PR:L) plus a reachable, already ADB-authorized device, while confining impact to Android shell-user privileges rather than host OS or root execution. No public exploit identified at time of analysis. Vendor-released patch: 3.0.10.

Authenticated command injection in Microsoft UFO's Mobile MCP server (versions prior to 3.0.9) lets a caller who holds a valid UFO_MCP_API_KEY pass shell metacharacters through the press_key tool's free-form key_code parameter and have them executed as the Android shell user on an already-authorized, connected device. Exploitation is remote and requires adb on the UFO host plus a reachable paired device, so it is not a host OS compromise, nor does it grant Android root - impact is bounded to Android shell-user privileges on the target handset. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis; the vendor has released a fix in version 3.0.9, and although the assigned CVSS is 9.1 (Critical), that score is driven largely by the scope change and network vector while the practical blast radius remains capped.

OS command injection in Progress Software's Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 allows attacker-controlled shell metacharacters embedded in a Swagger/OpenAPI schema name to run as arbitrary OS commands on a developer's workstation, because the derived {fileName} value is interpolated unquoted into the agent's shell-based temporary-file cleanup commands (rm -f / del /Q / rmdir). Exploitation is unauthenticated from a network perspective (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: a developer must load the attacker-supplied API specification into the generator, which is reflected in the UI:R metric and the 9.6 score with Scope:Changed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but a vendor patch (upstream commit 7ede6d96eb033d647ffdcabf8d8069c098293575 plus the Progress DataDirect Critical Security Alert Bulletin, September 2026) is available.

OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.

OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.

Authenticated users of Langflow versions prior to 1.9.0 can achieve remote code execution on the underlying host by adding an MCP server that uses the Stdio transport, because the user-supplied command field is passed directly to a shell with no validation, allowlisting, or sandboxing; the injected command executes immediately when the MCP server list is fetched, requiring no further victim interaction, and the env field additionally permits environment-variable injection (for example LD_PRELOAD or PATH overrides) for a second code-execution path. The vendor has issued a fix in 1.9.0 that restricts MCP stdio commands to an allowlist and blocks dangerous environment variables, and no public exploit code has been identified at time of analysis. The 9.9 CVSS score reflects the vector's scope change (S:C) and high confidentiality, integrity, and availability impact, though practical exploitability depends on the attacker holding a valid authenticated Langflow account with access to MCP server configuration.

OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration endpoint (POST/PATCH /api/v2/mcp/servers/{server_name}) or add an MCP Tools component to a flow to execute arbitrary operating-system commands on the Langflow host, running with the privileges of the Langflow process user. The vulnerability affects Langflow before 1.10.3, langflow-base before 0.10.3, and lfx before 1.10.3, and is reachable without any account on an exposed instance left in its default LANGFLOW_AUTO_LOGIN=true configuration because GET /api/v1/auto_login issues a token without credentials; when AUTO_LOGIN is disabled, any authenticated non-admin user is sufficient (CVSS vector PR:L), so no administrative role is required. The command fires automatically as soon as Langflow tries to connect to the configured server (listing servers, loading tools, or running a flow), and the resulting execution is not confined to the Langflow process security context per the S:C scope metric. No public exploit code was identified at time of analysis, and vendor-released fixes are available in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

Authenticated command injection in the Penpot SVG exporter prior to 2.18.0 allows a user with edit rights on a design file to place shell metacharacters in a text object's fill-color value, which the exporter interpolates unsanitized into a ppmcolormask command string and runs via child_process.exec, resulting in arbitrary command execution with the exporter service's privileges. The CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope change that crosses from the Penpot application into the underlying exporter host, with high confidentiality, integrity, and availability impact there. A second reachability path exists through a valid public share link to a malicious file, which lets anyone holding the link trigger the export without being an authenticated editor; no public exploit code has been identified at time of analysis, and the issue is fixed in 2.18.0.

Unauthenticated OS command injection in Ahsay AhsayCBS (versions 10.3.0 through 10.3.2) allows a remote attacker to execute arbitrary operating system commands on the backup server by supplying crafted shell metacharacters in the 'random' argument of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. The CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are required, and both the CVSS v4.0 score of 9.3 and the independently assessed CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) indicate full confidentiality, integrity, and availability impact on the host. Publicly available exploit code exists (E:P) and the flaw is described as published and usable, though there is no CISA KEV confirmation of active exploitation at time of analysis; reporting originates from a single source (VulDB), so corroboration is limited. A vendor patch is available: upgrading to AhsayCBS 10.3.4 resolves the issue.

OS command injection in PeaZip before 11.3.0 allows an attacker to run arbitrary commands on a victim's machine by embedding a specially crafted filename in an archive, provided PeaZip is running in a specific non-default configuration. The root cause is mishandling of the 'quotation character already used in the string' condition, which lets the injected filename escape the application's quoting and reach the shell; the CVSS 4.0 vector records no required privileges (PR:N) but explicitly captures attack prerequisites (AT:P), and exploitation is local with user interaction, meaning the victim must open or process the malicious archive. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor has addressed it in PeaZip 11.3.0, and the independent assessment rates this moderate priority - worth patching, but not an emergency.

Unauthenticated command injection in the web administration interface of multiple Digi International product families (including IX, EX, TX, Connect IT, AnywhereUSB Plus, Connect EZ, XBee Hive, Digi 54xx/63xx, and Digi LR54) allows an attacker on an adjacent network segment to execute arbitrary operating system commands with root privileges via a crafted HTTP POST. The flaw is rated CVSS 9.4 (CVSS 4.0) and requires no authentication or user interaction; the independent assessment confirms AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H on CVSS 3.1. No public exploit code or CISA KEV active exploitation is identified in the supplied data, and the main limiting factors are that the admin web server must be enabled and reachable, and the attacker must be adjacent to the device rather than exploiting across the open internet.

OS command injection in the Studio Space startup validation script of Amazon SageMaker Distribution (2.x, 3.x, and 4.x lines, as used by Amazon SageMaker Unified Studio) allows an authenticated remote user with project contributor permissions to execute arbitrary commands inside another project member's Studio Space and steal that member's temporary execution-role credentials via a crafted connection resource property. Exploitation is a shared/multi-tenant insider or compromised-collaborator scenario rather than unauthenticated external access, and it is additionally gated by user interaction because the victim's Studio Space must start and run the vulnerable startup script for the injected command to reach that member. No public exploit identified at time of analysis; vendor-released patches exist for supported lines, and end-of-support minor lines will not receive a fix.

Command injection in the Nx `@nx/docker` release pipeline (nx 21.4.0 through 22.7.7 and 23.0.0 through 23.1.0) lets an attacker who can influence `release.docker.repositoryName` or `registryUrl` in repository configuration execute arbitrary shell commands with the privileges of the release job. Because the plugin builds `docker tag`, image-lookup, and `docker push` calls as shell strings passed to `/bin/sh -c`, a malicious pull request or config change that reaches a `nx release version` or `nx release publish` run can exfiltrate registry credentials and cloud tokens; dry-run publishing does NOT prevent the vulnerable image-lookup pre-check from firing. This is a genuine but conditional CI/CD supply-chain risk rather than a drive-by remote exploit, and no public exploit code or confirmed active exploitation was identified at time of analysis.

OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute arbitrary commands at server/root privilege by supplying insufficiently validated input to the Multilang adminbin. Tracked as CVE-2026-93698 (CVSS 9.9, scope-changed), the flaw affects cPanel builds before 11.138.0.11, 11.136.0.45, 11.134.0.61, and 11.110.0.148, as well as WP Squared before 11.138.1.13; vendor patches are available. No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), but the scope-change to root privileges makes multi-tenant shared-hosting deployments the primary concern.

OS command injection in Johnson Controls EasyIO FS32 building-automation controller firmware before 3.0b63 allows an attacker who holds high-privilege credentials and can reach the device from an adjacent network segment to execute arbitrary operating-system commands, resulting in full compromise of the controller (CVSS 7.2; the vendor-assigned CVSS 4.0 vector carries an E:P exploit-maturity metric, i.e. proof-of-concept level). No confirmed active exploitation is indicated and no public exploit is identified at time of analysis - the CVE is not in CISA KEV - so the principal real-world gating factors are the PR:H authentication requirement and the AV:A adjacent-network position rather than weaponized, internet-facing exploitation. Defenders should treat the device as high-value OT infrastructure, since a compromised building-automation controller can be pivoted into the wider BAS/BMS network.

Command injection in the TDDPv2 service (/usr/bin/tddp) on TP-Link Archer AX90 V1 routers allows an unauthenticated attacker who is already positioned on the same adjacent network layer - wired LAN, Wi-Fi, or guest network - to inject operating system commands through the setProductVer command handler, which then run as root. The injected payload is executed during device boot, so the attacker must wait for or induce a reboot, and the device is not exploitable over the internet; a fixed firmware release is available from the vendor. Analysis found no public exploit code (no public exploit identified at time of analysis) and the issue is not in CISA KEV, so this is assessed as a credible but above-average-priority fleet risk rather than an internet-wide emergency.

Authenticated OS command injection in the TP-Link TL-WR841N v14 web management interface lets an administrator-level actor on the adjacent network execute arbitrary commands on the router by submitting a crafted IPv6 Gateway value through the IPv6 WAN configuration feature. Successful exploitation yields high confidentiality, integrity, and availability impact on the device itself - exposing stored configuration and credentials, permitting persistent changes to routing and services, and enabling disruption of device operation - but the flaw is post-authentication and reachable only from the LAN or Wi-Fi segment, not from the internet. No public exploit code and no confirmed active exploitation were identified at time of analysis; TP-Link has published updated firmware through its support and FAQ pages.

OS command injection in the Foreman foreman-tail helper utility shipped with Red Hat Satellite 6.19 for RHEL 9 allows a local, authenticated user to execute arbitrary system commands with the privileges of whoever runs the tool, because unsanitized arguments are fed into an eval-based path-expansion string and shell metacharacters such as ;, & and | are interpreted as commands. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is strictly local-scope, so it only matters where a lower-privileged account on a Satellite/Foreman host can reach the utility and thereby escalate its privileges. There is no network-facing attack path, no public exploit code has been identified at time of analysis, and EPSS is low (0.55%, 44th percentile), though Red Hat has issued patched packages (for example 0:3.18.0.14-1.el9sat for Satellite 6.19 on RHEL 9) via several RHSA advisories.

OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat: it is local-only, demands pre-existing delegated or privileged access to the rake tasks, and environments where only root invokes foreman-rake with no restricted sudo delegation are effectively not exposed; no public exploit code has been identified at time of analysis.

Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.

Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman_remote_execution plugin, lets an authenticated Satellite user who holds job-template execution permissions run arbitrary shell commands on managed hosts. The injection only applies to job templates whose effective_user property is configured as overridable: true, in which case the user-supplied value is not sanitized before the Satellite server instantiates the job execution environment, so the payload executes during instantiation rather than through the template or playbook content itself. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), this requires an authenticated account (PR:L) and the non-default overridable setting, and no public exploit identified at time of analysis; Red Hat has published an erratum, RHSA-2026:74503.

Command injection in Fortra BoKS Manager's crlserver component allows an authenticated principal holding the delegated CRL-URL-add capability to run arbitrary shell commands as root on the BoKS Master, yielding full compromise of the host that anchors the BoKS trust domain. Three delivery paths exist: the BCC administration console and the WSI REST/SOAP API are network-reachable and require no local sudo or suexec rule, while the cacrl command-line path needs a sudo/suexec rule for non-root use. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) confirms a network-reachable, scope-changing, high-integrity/high-availability impact; exploitation is gated by the attacker already possessing CRL-URL-add authorization plus an active crlserver on a BoKS Master, and no public exploit code was identified at time of analysis.

OS command injection in Genian SSL PNS (Xenics Auther) lets a remote attacker execute arbitrary operating-system commands on the host, with the only documented prerequisite being knowledge of a valid client access ID rather than the matching password. The flaw is tracked as CVE-2026-76146 (CWE-78) and carries a CVSS 4.0 base score of 8.4, where the AT:P attack-requirement metric encodes that access-ID precondition while PR:N/UI:N confirm no credentials and no user interaction are needed. Public reporting so far is limited to the vendor's own security-research advisory (GHSA-2597-v98f-frhj) issued via KR-CERT, there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a genuine high-impact exposure without confirmed active exploitation.

Local privilege escalation in Kiteworks Core lets an attacker who already holds code execution as an unprivileged backend service account invoke a privileged routine that mishandles attacker-influenced input, running arbitrary OS commands as root. The flaw requires a prior local foothold on the appliance - the CVSS vector (AV:L, PR:L, UI:N) confirms it cannot be reached directly over the network and demands an existing initial compromise or misconfiguration to obtain the service account. No public exploit code or active exploitation is identified at time of analysis, and the realistic risk is bounded by how easily that initial service-account access can be obtained on a given deployment; the vendor's advisory is GHSA-658c-86vw-g9hf.

Command injection in Kiteworks Core lets an authenticated administrator with elevated privileges run arbitrary operating-system commands as root on the affected appliance node, so an admin-only function can be turned into full host compromise. The flaw is remotely reachable and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N, base score 7.2), but PR:H is the dominant limiting factor: no unauthenticated or low-privilege path is indicated, so practical exploitation presupposes an insider or stolen high-privilege administrative credentials. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, keeping real-world urgency moderate and dependent on the value of the credentials required.

Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execution on one node of a clustered deployment to run operating system commands with elevated privileges on other nodes in the same cluster. The vulnerable function is not reachable from outside the cluster, so the attack path is confined to the internal cluster network and requires a pre-existing foothold on a cluster member; single-node deployments are not exposed. Rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change reflecting cross-node impact, and no public exploit identified at time of analysis.

OS command injection in Kiteworks Core appliances running versions before 9.5.0 allows an authenticated administrator to upload a configuration package whose contents are not sufficiently validated, resulting in arbitrary operating-system command execution that may run with elevated privileges on the underlying appliance. The attack requires a valid administrator account with access to the configuration-package upload functionality in the administrative interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High), so the high-privilege prerequisite is the dominant constraint and the realistic scenario is a malicious, compromised, or coerced administrator rather than opportunistic unauthenticated remote exploitation; the assessed vector is internally consistent and concurred with. No public exploit code and no confirmed active exploitation were identified at time of analysis, and successful exploitation yields full compromise of confidentiality, integrity, and availability on the affected appliance.

Command injection in Deno 2.7.0 through 2.9.7 on Windows allows an attacker who controls arguments passed to node:child_process spawn/exec calls with the shell option enabled to execute arbitrary OS commands with the privileges of the Deno process. The root cause is that Deno applied cmd.exe quoting rules to every shell, so arguments escaped for cmd.exe are reinterpreted as syntax by PowerShell/pwsh, a custom bash.exe, or another POSIX-style shell running on Windows. Exploitation requires a specific, non-default developer-chosen pattern - untrusted arguments plus the shell option on a Windows host, which is why the assessed vector carries AC:H/AT:P - and no public exploit has been identified at time of analysis, although the vendor has published an upstream fix in PR 36772.

Command execution on Windows-based JetBrains TeamCity servers allows authenticated users with Pipeline Git connection configuration privileges to run arbitrary OS commands via CRLF injection in connection settings, affecting versions before 2026.2, 2026.1.4, and 2025.11.8. The flaw requires authentication (PR:L per CVSS) and only impacts Windows deployments; no public exploit code has been identified at time of analysis. With a CVSS score of 8.8, successful exploitation grants high confidentiality, integrity, and availability impact.

OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP tool run arbitrary operating-system commands on the host by manipulating the tool's url argument, which is passed unsanitized into a shell command used for source extraction. Publicly available exploit code exists (referenced in the project's issue tracker), and the flaw is fixed in version 0.11.8; there is no indication of confirmed active exploitation in CISA KEV. The CVSS v4.0 score is 8.6 (with an assessed CVSS v3.1 equivalent of 8.8), reflecting high confidentiality, integrity, and availability impact, though the vector requires authorized tool access (PR:L) and real-world risk is bounded by the project's very small deployment footprint and whether the MCP tool endpoint is remotely reachable.

Command injection in the AiSOC actions service (AiSOC 7.2.0 up to, but excluding, 12.0.0) allows a low-privileged authenticated user to break out of quoted arguments in the file_path, path, script_name, or script_args parameters and execute arbitrary commands with SYSTEM/root privileges on CrowdStrike-managed endpoints. Exploitation requires that the deployment expose the actions service, that at least one CrowdStrike-managed endpoint is enrolled so a Real Time Response (RTR) session can be established, and that a mutating endpoint action (quarantine_file/rm, the automatic post-quarantine path_exists/ls probe, or a runscript path) is reachable with attacker-controlled input. No public exploit identified at time of analysis, and the practical weight of this flaw is tempered mainly by the small footprint of AiSOC deployments rather than by technical severity; note that the vendor's own fix commit documents that on default installs the dedicated actions-service token was never generated and its guard exempted itself while AISOC_DEV_MODE was enabled, so mutating routes could respond to anyone able to reach the port - materially lowering the authentication barrier described by the CVSS PR:L metric.

Command injection in the Ziroom ZHOME A0101 smart-home gateway running firmware 1.0.1.0 allows a remote, high-privilege authenticated attacker to execute arbitrary operating-system commands on the device by supplying shell metacharacters in the 'url' argument of the /api/ZRnetwork/ping diagnostic endpoint. Publicly available exploit code exists - the reporting researcher published a proof-of-concept write-up on GitHub - and the vendor was contacted early about the disclosure but never responded, so no vendor-released patch is available and no CISA KEV entry or EPSS score was provided in the source data. The published CVSS 4.0 score of 8.5 is driven upward by subsequent-system (SC:H/SI:H/SA:H) metrics that our independent assessment considers inflated for a single embedded gateway; the practical risk is bounded by the PR:H administrative authentication prerequisite in the vector and by the fact that consumer smart-home management interfaces such as this are normally reachable only from the LAN.

Command injection in DeepTutor 1.4.0 allows remote attackers to execute arbitrary shell commands through the ExecTool.execute function in /tutorbot/agent/tools/shell.py. The provided CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying no authentication or user interaction is required, though authentication requirements for the agent endpoint are not explicitly confirmed from the available data and should be verified against the actual deployment. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code was identified at time of analysis, and EPSS is low at 0.25% (15th percentile), reflecting that impact depends on a network-reachable instance of this niche, self-hosted product.

Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.

Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. No CISA KEV entry confirms active exploitation, and EPSS data was not provided.

Command injection in PyPA virtualenv before 21.7.12 allows an attacker who controls the environment's prompt value - via the --prompt argument, the VIRTUALENV_PROMPT environment variable, or the equivalent configuration setting - to run arbitrary cmd.exe commands on Windows with the privileges of the user who activates the generated environment. The flaw is confined to the batch activator: BatchActivator.quote() returns the prompt text unchanged, so a supplied double quote closes the `set "VAR=value"` assignment in activate.bat and any following cmd.exe operators are executed as live syntax when the victim runs the script. Coverage is limited by a local attack vector, Windows-only exposure, and mandatory victim interaction (generating and then activating the environment); no public exploit was identified at time of analysis, and a vendor fix is available in 21.7.12.

Command injection in the bash, zsh, and fish activation scripts generated by virtualenv releases prior to 21.7.13 lets a crafted virtual environment path or interpreter Tcl/Tk library path execute arbitrary commands with the privileges of any user who sources the activate script. The root cause is double quoting: values already escaped by shlex.quote are embedded inside an additional quoted context, so the surplus quotes terminate the data-only quoted run and leave shell metacharacters parsed as commands - reaching __VIRTUAL_ENV__ in bash/zsh when a relocated environment's recorded directory is absent, and __TCL_LIBRARY__/__TK_LIBRARY__ in fish. Exploitation requires attacker control of the affected path string plus the victim sourcing the script (CVSS 3.1 score 7.8, AV:L/AC:L/PR:N/UI:R, CWE-78 OS command injection); no public exploit identified at time of analysis, and the flaw is fixed in virtualenv 21.7.13 per PyPA advisory GHSA-p58f-9548-mpm2.

OS command injection in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows authenticated, low-privileged network attackers to enable a hidden debug interface and then deliver crafted input to a backend command handler, resulting in high impact to confidentiality, integrity, and availability of the device (assessed CVSS:3.1 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability to the device's management/control service, valid credentials of at least low privilege, and the specific firmware build; no user interaction is needed, and no public exploit identified at time of analysis. No confirmed vendor patch version is present in the available advisory data, so affected deployments should treat exposure reduction as the immediate priority.

Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated remote attacker with high (administrator) privileges to execute arbitrary commands on the underlying operating system, resulting in full loss of confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), but exploitation requires prior admin-level authentication (PR:H) to the management interface. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same adjacent network segment - within wireless range or on the same link-layer/LAN - to send specially crafted packets and execute arbitrary commands as a privileged user on the underlying operating system. Any Instant On AP running firmware up to and including 3.4.1.0 in its default configuration is affected, and the scope change (S:C) in the CVSS vector means compromise of the AP can extend into the host OS and anything it can reach. At the time of analysis no public exploit code or active exploitation telemetry has been identified, but the CVSS base of 9.6, the zero-privilege, zero-interaction attack path, and the ease of obtaining adjacent-network access make this a genuinely high-priority, patching-urgent issue rather than a theoretical one. There is no public exploit identified at time of analysis.

Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.

Command injection in the simple-git Node.js library (versions 3.15.0 through 4.0.0) allows remote, unauthenticated attackers to execute arbitrary shell commands under the identity of the Node.js process when a host application forwards attacker-controlled values into SimpleGitOptions.config or inline -c arguments and later runs git interpret-trailers, because the default blockUnsafeOperationsPlugin does not flag trailer.<token>.cmd (or trailer.<token>.command) as unsafe configuration. This is CWE-78 (OS command injection), rated 9.2 under CVSS v4.0 by the reporter and independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; exploitation is contingent on the application actually passing untrusted config into simple-git, so apps using only hard-coded/trusted configuration are not exposed and no privilege escalation beyond the Node process is possible. A vendor-released patch is available in simple-git 4.0.1, which introduces the allowUnsafeCommandBinaries category; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases before 4.0.0 and allows unauthenticated remote attackers to execute arbitrary commands whenever a consuming application forwards attacker-influenced values into a git push argument list. The library's default blockUnsafeOperationsPlugin matches dangerous options by literal spelling only, so unambiguous Git long-option abbreviations such as --receive-p, --receive-pa and --exe bypass detection, are expanded by Git itself, and reach --receive-pack on a local or file remote where the injected command runs. Publicly available exploit code exists (a published gist plus the detailed upstream advisory proof of concept), but there is no CISA KEV confirmation of active exploitation; EPSS is 0.36% (28th percentile) and SSVC marks the issue Exploitation: none, Automatable: no, because three consumer-specific preconditions must coincide.