OS Command Injection

OS command injection in FishCodeTech Muteki up to version 0.2.5 enables remote low-privileged attackers to execute arbitrary operating system commands through unsanitized input handled by the Default Local Worker Backend component, specifically via the application's .claude/settings.json configuration file. Publicly available exploit code (POC) exists, referenced from a dedicated exploit report repository, raising the practical exploitability despite the product's limited deployment footprint. The project maintainer closed the issue without a patch, announcing that Muteki will be refactored and shut down, making this effectively an unpatched, end-of-life vulnerability with no vendor remediation path. No public exploit identified at time of analysis as confirmed active exploitation by CISA KEV.

OS command injection in sworddut mcp-ffmpeg-helper affects the handleToolCall function in src/tools/handlers.ts across all three released versions (0.1.0, 0.1.1, 0.2.1), allowing a local low-privilege attacker to execute arbitrary OS commands by manipulating the format argument. Publicly available exploit code exists via a GitHub issue, and the vendor has not responded to the coordinated disclosure, leaving all known versions unpatched. This is not listed in CISA KEV; exploitation requires local access, which substantially limits real-world exposure.

OS command injection in TanStack devtools-vite 0.7.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `packageName` argument to the `installPackage` function within the Development Devtools Event Bus component. Exploitation is constrained to local access with high attack complexity, yielding limited confidentiality, integrity, and availability impact on the vulnerable system only. A public proof-of-concept was disclosed via GitHub issue #464 prior to any vendor response; no patch has been released as of this analysis.

Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.

Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS-level commands via the cmdinput parameter of the /goform/exeCommand endpoint. The underlying formexeCommand function passes user-controlled input to a system command without adequate sanitization, exposing the router's underlying Linux OS. A proof-of-concept exploit has been publicly disclosed on Notion (referenced via VulDB), elevating real-world risk beyond the moderate CVSS 4.0 score of 5.3, which appears to understate the practical OS-level impact typical of router command injection primitives.

Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the `editNameMit` parameter within the `formeditFileName` function at the `/goform/editFileName` web management endpoint. A public proof-of-concept exploit has been released, confirmed by the CVSS 4.0 E:P modifier and a linked Notion-hosted exploit writeup. No CISA KEV listing at time of analysis, but the public PoC significantly lowers the skill bar for exploitation against any CH22 device with an exposed or accessible management interface.

Command injection in TRENDnet TEW-823DRU firmware 1.1.02b01 allows a remote, authenticated attacker to inject arbitrary OS commands through the nvram_get function in the CLI Configuration Tool. Exploitation requires high-privilege credentials (PR:H per CVSS 4.0), limiting the attacker pool to those who have obtained administrative access. A public proof-of-concept is documented on GitHub; no CISA KEV listing has been recorded at time of analysis, and no vendor-released patch has been identified.

Command injection in TRENDnet TEW-821DAP 2.2.01b05 allows remote low-privileged attackers to execute arbitrary OS commands via the `filename` argument in the `/cgi-bin/upload.cgi` CGI endpoint's SSI component. A public proof-of-concept exploit is available on GitHub, raising the operational risk above what the vendor-supplied CVSS 4.0 score of 2.1 suggests. No active exploitation has been confirmed via CISA KEV, but the combination of network accessibility, low complexity, and public PoC makes this a credible threat to any deployed unit.

Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the fileNameMit parameter of the formcreateFileName function at the /goform/formcreateFileName endpoint. A public exploit proof-of-concept has been disclosed, making this actively weaponizable against unpatched devices. No patch has been confirmed by the vendor at time of analysis.

Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, unauthenticated attackers to execute arbitrary OS commands as root. The flaw stems from unsanitized user-supplied input passed directly to a system call inside the firmware update handler, granting full device compromise. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for physical device access.

Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. A public proof-of-concept has been published on GitHub as a PDF document; this is not currently listed in the CISA KEV catalog.

OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.

OS command injection in chenhg5 cc-connect up to and including v1.4.1 allows remote attackers to execute arbitrary operating system commands by manipulating the `exec` argument passed to the `shellExecCommand` function in `core/engine.go` via the Management API. The CVSS 4.0 vector (PR:N) indicates no authentication is required, making this network-exploitable without credentials. A public exploit exists (E:P in the supplied vector), and the upstream GitHub issue was closed automatically due to maintainer inactivity, indicating no patch has been issued.

Command injection in TRENDnet TEW-755AP wireless access points (firmware through 20260702) allows a network-authenticated attacker to execute arbitrary OS commands by submitting crafted input to the email server configuration endpoint. The vulnerability resides in the `log_email_server` function within `/cgi-bin/email.cgi` of the SSI component, where user-supplied parameters are passed unsanitized to a system call. A public proof-of-concept exploit script is available on GitHub, raising the likelihood of opportunistic exploitation against exposed management interfaces. No public KEV listing exists at time of analysis.

SPL command injection through the geostats command in Splunk Enterprise allows an authenticated low-privileged attacker to execute arbitrary Search Processing Language commands under the security context of a second, higher-privileged victim user. Affected release branches include 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. Exploitation requires phishing an authenticated target into initiating the attacker-controlled search in Splunk Web; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

SPL injection via the dashboard PDF export feature in Splunk Enterprise allows a 'power'-role attacker to store malicious Search Processing Language that executes under the permissions of a separate, higher-privileged authenticated user when that user exports the dashboard as a PDF. Affected versions span four maintained release branches: 10.4 below 10.4.1, 10.2 below 10.2.6, 10.0 below 10.0.9, and 9.4 below 9.4.14. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog; successful exploitation requires chaining a held 'power' role with a successful phishing step against the victim user.

Command injection in TRENDnet TV-IP751WIC firmware 11.03.03 enables remote authenticated attackers to execute arbitrary OS commands through the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The flaw stems from unsanitized user input passed directly to a shell command in the time-setting CGI handler. A public proof-of-concept exploit (poc-time-injection.py) is confirmed available on GitHub, lowering the barrier to exploitation significantly; no CISA KEV listing has been issued at time of analysis.

Command injection in TRENDnet TEW-821DAP firmware 2.2.01b05 allows authenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ipaddr` parameter of the `/cgi-bin/ping.cgi` endpoint. The SSI component passes this input unsanitized to `popen`/`system`, enabling full OS command execution on the device. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation against devices reachable over the network.

Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. No public exploit has been identified at time of analysis, but successful exploitation yields complete administrative compromise of a network perimeter device - making this a high-impact target despite its moderate CVSS 4.0 score of 5.3.

Remote code execution in Renovate's bazel-module and bazelisk managers exposes self-hosted instances running versions 43.65.0 through 43.102.11 to arbitrary code execution triggered by malicious Bazel dependencies. When lockFileMaintenance invokes 'bazel mod deps', dependency-provided code within ctx.execute statements executes directly on the Renovate host - enabling both insider and outsider supply chain attacks against affected configurations. No public exploit code has been identified at time of analysis, and a vendor-confirmed patch is available at 43.102.11.

OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to a directory containing a crafted filename and the preview-tabbed feature is triggered. The unsanitized filename variable is interpolated directly into a generated shell command, enabling any attacker capable of placing a maliciously named file on a shared filesystem, removable media, or inside a delivered archive to execute code with the privileges of the victim's nnn process. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the realistic social-engineering delivery path against developer and power-user workstations - populations that routinely extract archives and browse shared mounts - makes it operationally relevant despite the moderate CVSS score.

Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared filesystem, removable media, or inside an extracted archive to execute arbitrary shell commands with the privileges of the nnn process. The unsanitized path variable is embedded directly into shell commands generated by nnn's batch copy and move workflows, enabling a single-quote escape followed by shell metacharacters in a directory name to break out of the intended string context. No public exploit has been identified at time of analysis, but exploitation requires only that the victim navigate into the crafted directory and initiate a batch copy or move operation.

Command injection in TRENDnet Router firmware 1.1.02b01 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `wan_type` parameter in the `/cgi-bin/ping.cgi` endpoint. A publicly available proof-of-concept exploit (hosted on GitHub) lowers the technical bar for exploitation. The provided CVSS 4.0 score of 2.1 with low impact metrics is notably inconsistent with typical command injection severity and warrants independent verification against actual privilege boundaries of the CGI process.

Command injection in TRENDnet TEW-823DRU firmware version 1.1.02b01 allows a network-accessible, low-privileged authenticated attacker to execute arbitrary OS commands by manipulating the Hostname parameter in the /cgi-bin/admin.cgi endpoint. The flaw is classified as CWE-77 and carries a CVSS 4.0 base score of 2.1 with the E:P threat modifier applied, reflecting a publicly available proof-of-concept exploit on GitHub. No vendor-released patch has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

Pyenv's version-selection shell scripts silently redirect Python interpreter selection to an unintended installed version when the PYENV_VERSION or .python-version value contains shell glob metacharacters and a matching file exists in the working directory. All seven libexec scripts (pyenv-version-name, pyenv-which, pyenv-prefix, pyenv-local, pyenv-global, pyenv-version, pyenv-versions) expand the version string without disabling glob expansion via set -f, allowing pathname expansion against the current directory's contents. The fix in v2.8.0 adds set -f/set +f guards around all affected expansions. No public exploit identified at time of analysis; the CVSS 4.0 score of 2.0 with AT:P reflects the constrained exploitation conditions.

Macro command injection in Notepad++ prior to 8.9.7 enables local privilege escalation by bypassing HMAC integrity validation on shortcuts.xml-sourced macros. An attacker who can place a malicious shortcuts.xml in the application's settingsDir can embed macro payloads that invoke Scintilla actions and the internal 'Open in Default Viewer' command within an elevated Notepad++ process, resulting in protected file modification or elevated command execution when a user triggers the macro. No CISA KEV listing and no public proof-of-concept are known at time of analysis; exploitation requires multiple aligned local prerequisites.

Remote command injection in kylecui NetForensicMCP 2.1.0 allows authenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the `interface` or `protocol` arguments passed to the `execAsync` function in `index.js`. A public proof-of-concept exists via a GitHub issue, though this vulnerability is not currently listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. The CVSS 4.0 score of 5.3 (Medium) reflects limited confidentiality, integrity, and availability impact with no lateral scope change, but the public exploit and absent vendor response elevate practical urgency for any deployment.

Command injection in uniget CLI's hook editing feature enables arbitrary code execution via a maliciously crafted EDITOR environment variable. The `hooks edit` subcommand reads the UNIGET_EDITOR or EDITOR environment variable and splits it on whitespace using Go's `strings.Split()`, causing embedded shell metacharacters such as `&&` to be passed as discrete exec arguments that downstream shell-backed editor wrappers then interpret as command separators. Exploitation was publicly demonstrated in GHSA-qmcq-xw74-w667 with a confirmed POC achieving code execution as uid=1000; no public exploit identified at time of analysis beyond the advisory-embedded POC, and no CISA KEV listing exists.

Command injection in JetBrains IntelliJ IDEA before 2026.2.1 enables arbitrary command execution through crafted Markdown preview content when a user opens and trusts a malicious project. The flaw (CWE-77) is constrained to trusted projects and requires the victim to interact with the Markdown preview, limiting its practical reach. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS score of 3.6 (Low) reflects these mitigating conditions.

Sieve script injection in Roundcube Webmail's managesieve plugin allows authenticated users to bypass the administrator-configured `managesieve_disabled_actions` restriction by embedding unquoted special characters in a filter rule name. Affected branches are 1.6.x before 1.6.18 and 1.7.x before 1.7.3; instances without the managesieve plugin are not affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. The vendor has confirmed the vulnerability, vendor-released patch version 4.9.0 is available, and no public exploit identified at time of analysis, though the GL.iNet-hosted writeup substantially documents the attack mechanism.

OS command injection in GL.iNet BE9300 and MT6000 router firmware 4.8.x allows remote low-privileged attackers to execute arbitrary operating system commands via unsanitized dest_port and dest_ip arguments in the Firewall-management RPC component. The vendor has confirmed the vulnerability through their CVE issues GitHub repository and released a fix in firmware version 4.9.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute arbitrary shell commands via the Wi-Fi Timer Power-Schedule feature by manipulating the switch_power or restore_power arguments. The vendor has independently confirmed the vulnerability exists. A public write-up exists in the vendor's own CVE issues repository describing the attack as a cron-based RCE path, and no public exploit with KEV listing has been identified at time of analysis. The CVSS 4.0 score of 5.3 (with PR:L) reflects that low-privilege authentication is required, but the real-world impact of arbitrary command execution on a network router warrants elevated attention beyond what the score conveys.

OS command injection in android-mcp-server's `build/index.js` allows local low-privilege attackers to execute arbitrary shell commands by supplying malicious values for parameters such as `deviceId`, `packageName`, `permission`, or `extras` fields passed to the `child_process.exec()` ADB command builder. The vulnerable code interpolates user-supplied input directly into shell command strings without sanitization, making exploitation trivial for any local user with access to the MCP server process. A publicly available proof-of-concept exists via the GitHub issue tracker, and a patch commit has been published; no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. A public proof-of-concept has been disclosed (GitHub PDF), and the vendor did not respond to responsible disclosure.

Command injection in Edimax EW-7478APC wireless access point firmware 1.04 enables remote authenticated attackers to execute arbitrary OS commands by manipulating the `interface` argument sent to the `/goform/stainfo` CGI endpoint. A public proof-of-concept exploit has been disclosed (CVSS 4.0 supplemental metric E:P confirmed), the vendor has not responded to disclosure, and no patch exists - leaving the attack surface permanently open absent network-level mitigations. No confirmed active exploitation (not in CISA KEV) at time of analysis, but the public POC lowers the bar for opportunistic targeting.

Command injection in Edimax EW-7478APC firmware 1.04 enables remote attackers with low-privilege access to execute arbitrary OS commands by supplying shell metacharacters in WAN credential fields (pppUserName, pptpUserName, or L2TPUserName) through the /goform/setWAN endpoint. A publicly available proof-of-concept exploit has been published, raising real-world exploitation risk despite the moderate CVSS score. No vendor patch exists - the vendor did not respond to the coordinated disclosure, leaving affected users without an official remediation path.

Command injection in Edimax EW-7478APC firmware 1.04 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `rootAPmac` parameter submitted to the `/goform/formWlbasic` CGI endpoint. A public proof-of-concept exploit has been disclosed via VulDB and a linked Notion page. The vendor did not respond to coordinated disclosure, leaving no patch available and the exposure window indefinite.

Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a denial of service condition that extends beyond the vulnerable component due to a scope change (S:C per CVSS vector). The flaw, rooted in CWE-78 improper neutralization of OS command elements, requires only low-privilege credentials and no user interaction to exploit over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though a vendor patch is available.

TCL command injection in a reflector client component, reported via Ubuntu's vendor security channel (GHSA-pc2g-2p95-4cr5), allows an attacker to inject arbitrary TCL commands through unsanitized input processed by the client. The specific impact scope - including whether this enables OS-level command execution or is confined to the TCL interpreter - cannot be confirmed from available data, as no CVSS vector, CWE, or patch advisory has been published. No public exploit or CISA KEV listing has been identified at the time of analysis.

OS command injection in PDF::WebKit for Perl (versions through 1.2) allows arbitrary command execution under the process UID when untrusted input is forwarded as an output path or stylesheet path to `to_pdf`, `to_file`, or `_style_tag_for`. The root cause is Perl's 2-arg `open()` combined with the diamond operator, which interprets pipe-flanked strings (`| cmd` or `cmd |`) as shell commands and redirect-prefixed strings (`> path`) as file write operations rather than filenames. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the technique exploits well-documented Perl behavior making reproduction trivial for any developer familiar with the language.

Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. No public exploit identified at time of analysis, though the GitHub security advisory GHSA-6v4m-fw66-8r4x includes functional proof-of-concept code; KEV listing is absent.

OS command injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to disrupt system availability by submitting crafted input containing special elements that are improperly neutralized before being passed to OS-level commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms network-reachable exploitation requiring only low-privilege credentials, with high availability impact and a secondary low integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across actively supported IBM i releases make patching a priority for affected IBM Power Systems environments.

SQL parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions by submitting specially crafted SQL input that is not properly neutralized before processing. The CWE-78 (OS Command Injection) classification combined with the SQL-parameter attack surface suggests that malicious input may propagate beyond the SQL layer to OS-level command execution, though the exact propagation path is not fully detailed in available data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Command injection in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7 allows an attacker who can influence the installation directory path to execute arbitrary PowerShell commands in the installer's security context. The vulnerable `RegisterMSIX` function in the NSIS installer script (`nppSetup.nsi`) unsafely interpolates the `$INSTDIR` variable into a PowerShell `-Command` string, enabling subexpression syntax such as `$()` embedded in a crafted directory name to be evaluated as live commands. Exploitation additionally requires that the user selects the optional Explorer context menu shell extension component during installation. The vendor has confirmed the fix in version 8.9.7; no public exploit or active exploitation has been identified at time of analysis.

Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.

Command injection in Visual Studio Code versions prior to 1.132.1 enables remote unauthenticated attackers to disclose sensitive information from a victim's system over a network. Exploitation requires user interaction - the victim must open or engage with attacker-controlled content such as a malicious workspace, configuration file, or repository - consistent with the CVSS UI:R metric. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch (1.132.1) is available via the Microsoft Security Response Center.

Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.

Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent adversary who can intercept and modify local traffic to compromise both the confidentiality and integrity of affected devices. The root cause is CWE-295 (Improper Certificate Validation), meaning the device fails to properly authenticate the remote party during a network exchange - likely firmware update or cloud management traffic - enabling a suitably positioned attacker to inject commands without authenticating to the device. Exploitation is constrained by the requirement for physical network adjacency, active MitM capability, and affected region-specific SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.

OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.

Command injection in Dokploy's Docker build pipeline allows authenticated application editors to execute arbitrary OS commands on the Dokploy host by supplying shell metacharacters in the dockerContextPath build configuration field. The malicious path value flows from the dashboard UI through getDockerContextPath() directly into an unquoted cd shell command executed via execAsync, enabling full host-level code execution under the Dokploy server process. All Dokploy installations prior to version 0.29.13 are affected; no active exploitation or public exploit code has been identified at time of analysis, though exploitation requires only a low-privilege authenticated session.

Command injection in Dokploy's database backup and restore utilities (prior to v0.29.13) lets an authenticated administrator execute arbitrary shell commands inside managed database containers by supplying crafted values in database name, username, or password configuration fields. All supported database types are affected - PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL - with subsequent-system impact rated High across confidentiality, integrity, and availability, reflecting that injected commands run inside the database containers rather than Dokploy itself. No confirmed active exploitation (not in CISA KEV), but the public fix PR includes functional injection payload examples that effectively demonstrate the technique, and the vendor has confirmed the issue via GitHub Security Advisory GHSA-qc73-mp78-4833.

Command injection in Dokploy's `createCommand()` function allows authenticated users with compose deployment access to execute arbitrary OS commands on the underlying Docker host. All Dokploy releases before 0.29.13 are affected via CPE cpe:2.3:a:dokploy:dokploy:*. The official CVSS score of 6.5 with C:H/I:N/A:N materially understates actual impact - successful exploitation yields full host-level command execution, not merely information disclosure. No public exploit identified at time of analysis, though working injection payloads are published directly in the fix commit's test suite.

OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.

Command injection in NightTrek Ollama-mcp (all commits through 80cf2e17) allows a local low-privileged attacker to execute arbitrary operating system commands by supplying crafted values to the name, modelfile, source, or destination arguments processed in src/index.ts. A proof-of-concept exists (CVSS 4.0 threat metric E:P), and the project maintainer has not responded to the responsible disclosure issue report filed on GitHub. No patch is available; the project operates exclusively on a rolling release model with no versioned releases.

Command injection in NightTrek Supabase-MCP's `generate_types` component exposes systems to arbitrary OS command execution via unsanitized `schema` argument input. Exploitation is restricted to local, low-privileged attackers who can invoke the affected MCP tool - significantly constraining real-world impact. The CVSS 4.0 score of 1.9 reflects these narrow conditions; however, a proof-of-concept is indicated by the E:P modifier in the provided vector. No vendor patch exists and the maintainer has not responded to the responsible disclosure issue filed on GitHub.

Command injection in NellyW8 MCP4EDA 1.0.0 allows a local low-privileged attacker to execute arbitrary OS commands by manipulating the design_name or vcd_file arguments passed to the run_openlane or view_waveform components. The vulnerability arises from unsanitized argument handling and was reported to the maintainer via GitHub issue #3, but has received no vendor response to date. A proof-of-concept exploit exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been identified.

Command injection in andreahaku/codex_mcp's `ask` MCP Tool allows a low-privileged local attacker to execute arbitrary OS commands by supplying shell metacharacters in the `model` argument passed unsanitized to a system call in src/codex-process-simple.ts. The project uses no versioning, meaning all deployments up to commit 1ff521cc are affected with no safe version to target for upgrade. A proof-of-concept exists per the CVSS 4.0 E:P supplemental metric, and the maintainer has not responded to the disclosed issue, leaving no vendor-released patch available.

Command injection in MauricioMilano coder-api (all versions through 1.1.0) allows a local, low-privileged attacker to execute arbitrary OS commands via the createProject function in the Projects Endpoint. The vulnerability stems from unsanitized input passed to a system command in src/core/projects.ts, enabling an attacker with local access to manipulate project creation inputs and achieve code execution in the application's runtime context. A proof-of-concept exploit exists (CVSS 4.0 E:P), no patch has been released, and the project maintainer has not responded to the responsible disclosure report.

Command injection in andreahaku llm_memory_mcp allows local attackers with limited privileges to execute arbitrary OS commands by manipulating the `hash` argument passed to the `auto.capture` function in `GitHooksManager.ts`. All commits up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected, and a proof-of-concept is indicated as available via the CVSS 4.0 E:P enrichment. No patch has been released, and the project maintainer has not responded to the coordinated disclosure reported via GitHub issue.

Command injection in slidev-builder-mcp 2.1.0 allows local low-privilege users to execute arbitrary OS commands by passing shell metacharacters in the `outputDir` argument to the `generateChart` function of the generateAssets Tool. The attack is confined to local access only (CVSS 4.0 AV:L), and the CVSS 4.0 E:P modifier confirms publicly available proof-of-concept code exists. No vendor patch has been released as the project has not responded to the disclosure; no confirmed active exploitation (not in CISA KEV) has been identified at time of analysis.

Command injection in MIMICLab mcp-pdf-vision 1.1.0 allows a local low-privileged attacker to execute arbitrary OS commands by supplying crafted values to the pdfPath or sessionId arguments of the load_pdf function in src/index.ts. The CVSS 4.0 score of 4.8 (Medium) reflects a local-only attack surface with limited confidentiality, integrity, and availability impact; no scope change to subsequent systems is possible. A proof-of-concept exists per the E:P exploit maturity indicator in the CVSS 4.0 vector, and no patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue.

Command injection in MCPGateway's Claude Usage Range Endpoint allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `since` date argument passed to `getUsageByDateRange` in `src/services/claude-usage.ts`. All versions up to commit 549f494a9e363f40530149de324b8097de424230 are affected, with a proof-of-concept exploit publicly available via the project's GitHub issue tracker. No patch has been released; the maintainer has not responded to the coordinated disclosure despite early notification, leaving deployments with no vendor-supported remediation path.

Command injection in Kirachon context-engine up to version 1.9.0 allows adjacent authenticated attackers to execute arbitrary OS commands through the review-git-diff MCP endpoint. The root cause is the execGitCommand function in src/mcp/utils/gitUtils.ts passing user-supplied git reference arguments - branch names, commit hashes, and path patterns - directly to a shell-invoked subprocess without sanitization, enabling shell metacharacter injection. No public exploit has been independently distributed, though the patch commit itself embeds proof-of-concept test cases confirming the injection vector; version 1.9.1 resolves the issue.

Command injection in INQUIRELAB mcp-bridge-api's Servers Endpoint allows unauthenticated remote attackers to execute arbitrary OS commands by manipulating the command/args parameters in mcp-bridge.js without sanitization. The product uses a rolling release model and all commits up to b30a82aa1d1d1139e0de846c41c8aadee6e06114 are confirmed affected. No released patch exists - a remediation pull request has been submitted but was awaiting acceptance at time of disclosure. No public exploit or KEV listing identified at time of analysis.

Arbitrary code execution in the Ruby LSP VS Code extension prior to version 0.10.4 is achievable by any attacker who can deliver a malicious repository to a developer. Workspace-level settings in `.vscode/settings.json` were trusted by the extension to configure the Ruby executable path, version manager binaries, and Bundler Gemfile - all of which the extension invokes at startup - allowing an attacker-controlled repository to redirect those invocations to arbitrary binaries. The Ruby LSP gem and language server clients in other editors are explicitly not affected; no public exploit has been identified at time of analysis, and a vendor fix is available in version 0.10.4.

OS command injection in HKUDS nanobot 0.2.0 and 0.2.1 allows a low-privileged remote attacker to bypass the configured shell command allowlist by submitting chained shell commands using operators such as `&&`, `||`, `;`, `|`, or `&`. The `ExecTool._guard_command` method in `shell.py` validated the entire raw command string as a single unit against allow patterns, meaning only the first chained segment needed to match - subsequent malicious segments executed unchecked. A public proof-of-concept exploit exists; the vulnerability is not listed in CISA KEV but the CVSS 4.0 E:P modifier confirms publicly available exploit code elevates urgency beyond the base score of 5.3.

Command injection in NocteDefensor LudusMCP through version 1.0.24 allows a local attacker with low privileges to execute arbitrary OS commands by supplying crafted input to the `command` or `args` parameters of the `executeArbitraryCommand` and `executeCommand` functions in `src/ludusMCP/cliWrapper.ts`. A proof-of-concept exploit is publicly referenced (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), and the vendor has not responded to the coordinated disclosure. No active exploitation has been confirmed via CISA KEV, but the public POC lowers the exploitation barrier for any local attacker on systems running this MCP server.

Command injection in NocteDefensor LudusMCP (all versions through 1.0.24) permits a local low-privileged attacker to execute arbitrary OS commands by manipulating the Description argument passed to SecretDialog.showSecretDialog within the get_credential_from_user component (src/utils/secretDialog.ts). Exploitation is constrained to the local host and requires at minimum low-privilege OS credentials, consistent with the CVSS 4.0 AV:L/PR:L metrics and a final score of 1.9. A proof-of-concept exploit has been publicly posted (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), but no vendor patch has been released - the project has not responded to the coordinated disclosure as of this analysis.

Command injection in LeeSinLiang's godot-mcp 0.1.0 allows local low-privileged users to execute arbitrary OS commands by supplying a crafted projectPath argument to the executeOperation function in src/index.ts, specifically through the create_scene and add_node MCP operation handlers. This Model Context Protocol server for the Godot game engine was disclosed via a GitHub issue report that the project maintainer has not yet addressed. No active exploitation has been confirmed and no CISA KEV listing exists, though the CVSS 4.0 temporal metric E:P confirms publicly available proof-of-concept exploit code.

Command injection in MissionSquad mcp-api through version 1.11.8 enables remote authenticated users to execute arbitrary OS-level commands on the host by supplying a crafted version string to the NPM package installation endpoint. The root cause is string interpolation of unvalidated user input into a Node.js `exec()` call, which passes the resulting string through a shell interpreter - making shell metacharacters in the version parameter an effective injection vector. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no active exploitation has been confirmed by CISA KEV. A patched release (v1.11.9) is available.

Command injection in Kino-Kafkaesque ssh-mcp-server's SSH Command Handler allows a local low-privilege attacker to execute arbitrary commands by manipulating the host or username arguments passed to the ssh_exec function in src/index.ts up to commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Proof-of-concept code exists (CVSS E:P), though the maintainer explicitly disputes the severity, stating the tool's intended threat model assumes fully trusted local callers who already possess meaningful shell execution capability via the MCP interface. The actual existence of this vulnerability is formally in question per the CVE description, and no CISA KEV listing is present.

Command injection in OpenHands versions up to 0.62.0 allows authenticated remote attackers to execute arbitrary OS commands by manipulating inputs processed by the initialize_repo function within the pull request resolver workflow. The vulnerable file OpenHands/resolver/send_pull_request.py was entirely removed in version 1.7.0, suggesting the fix is architectural rather than a targeted patch. No public exploit has been identified at time of analysis, though the vendor's deletion of the original GitHub issue report is a notable transparency concern; no CISA KEV listing exists.

Command injection in nearai ironclaw up to version 0.29.1 allows remote attackers with low-privilege authenticated access to bypass the shell command risk classifier by supplying crafted shell metacharacters, quotes, or escape sequences to the classify_command_risk function in src/tools/builtin/shell.rs. The classifier's naive string analysis fails to account for proper shell tokenization, enabling malicious commands to be categorized as safe and subsequently executed by the agent's built-in shell tool. A public proof-of-concept exploit exists (GitHub issue #4862); the vulnerability is not listed in CISA KEV, and all impact dimensions are rated Low, consistent with a sandbox-constrained environment rather than full system compromise.

Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-privilege attacker to poison Docker and Fly.io setup commands displayed in the web interface, causing arbitrary shell code to execute on the machine of any user who copies and runs the generated command. Affected versions span 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 4.9 reflects the high privileges required and the indirect execution path through a secondary user's action.

Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3 via the DevTools 'reveal in file manager' handler, which incorrectly forwarded attacker-supplied paths to the OS shell-open primitive rather than a safe folder-reveal call. Exploitation requires an attacker to already control JavaScript execution within the DevTools frontend - most plausibly through a malicious DevTools extension - while DevTools is open against a window loading untrusted content. No public exploit code exists and the vulnerability is not listed in CISA KEV; patched releases are available across all active Electron stable and beta branches.

Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.

Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.

OS command injection in Sangfor Fort (Operation and Maintenance Security Management System) up to version 3.0.13 allows remote, unauthenticated attackers to execute arbitrary OS commands via a crafted request to the login endpoint `/fort/portal_login`. The flaw resides in the `DpLoginController` Java class and requires no authentication, making it trivially reachable across any network path to the appliance. A public proof-of-concept exploit exists; the vendor did not respond to coordinated disclosure, and no patch has been released at time of analysis.

OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.

OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.

OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary shell commands by supplying a crafted argument value to a Shell-mode action that uses a custom regex: argument type. The root cause is that checkShellArgumentSafety in service/internal/executor/arguments.go omitted regex: types from its unsafe-argument blocklist, permitting regex-validated values to be interpolated unsanitized into an sh -c command string via wrapCommandInShell. No active exploitation has been confirmed (no CISA KEV listing), but a public GitHub security advisory and a fix-bearing release (3000.17.0) are available.

Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.

Command injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege attackers with adjacent network access to execute arbitrary code as root. The vulnerability stems from improper sanitization of special elements (CWE-78) in OS command execution. No public exploit or active exploitation reported.

OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.

OS command injection in the release-it conventional-changelog plugin (up to v11.0.1) allows a local low-privileged user to execute arbitrary operating system commands by supplying a crafted value for the infile argument to the writeChangelog function in index.js. The vulnerability has been publicly disclosed through a GitHub issue report, and exploit code is available. No patch has been released at time of analysis, as the project maintainer had not responded to the responsible disclosure.

OS command injection in bahmutov/find-cypress-specs versions through 1.54.12 allows a local attacker with limited privileges to execute arbitrary shell commands by supplying a crafted value to the --branch argument, which is passed unsanitized to shell.exec in src/index.js. The vulnerability is constrained to local execution and carries low impact across confidentiality, integrity, and availability per the CVSS 4.0 vector. A public proof-of-concept exists and the vendor has not responded to the coordinated disclosure report filed via GitHub issue #423; no patch has been released at time of analysis.

OS command injection in the @publint/pack component of publint (up to v0.1.4) allows a local attacker who controls the packageManager input to execute arbitrary shell commands via unsanitized string interpolation passed to child_process.exec. The affected functions packAsJson and pack in src/node/pack.js and src/node/pack-as-json.js construct shell command strings by concatenating the packageManager variable directly into template literals before passing them to util.promisify(cp.exec). A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), though the maintainer explicitly states exploitation requires untrusted input usage, which is outside the package's intended use case and not confirmed actively exploited in the wild.

OS command injection in Syncfusion ej2-javascript-ui-controls through version 33.2.3 allows a local attacker with low-privilege access to execute arbitrary operating system commands via unsanitized input passed to the child_process.exec function referenced in package.json. This is a build-time or script-execution sink, meaning exploitation is most likely during npm script invocation in developer workstations or CI/CD pipelines rather than in end-user browsers. A public proof-of-concept exists (GitHub issue #215); no CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects limited real-world impact constrained to the local system.