OS Command Injection

Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.

Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.

Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.

OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.

OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.

Remote code execution in Wekan prior to version 9.75 allows any authenticated user to execute arbitrary OS commands as the Wekan server process by embedding shell metacharacters in an uploaded filename. The flaw exists in models/fileValidation.js, which interpolated the user-supplied file path into an admin-configured external scanner command line wrapped only in double quotes before passing it to asyncExec - a promisified child_process.exec that spawns /bin/sh -c - allowing double-quote-permeable constructs like $(cmd) and backtick substitutions to escape argument boundaries. No public exploit has been identified at time of analysis, though the published commit diff in GHSA-x3xm-pxrv-jg7p constitutes a near-complete exploitation guide.

OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.

OS command injection in Dell RecoverPoint for Virtual Machines versions 6.0.3 and 6.0.3.1 enables a high-privileged remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability stems from improper neutralization of special elements passed to OS commands (CWE-78), resulting in full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the vendor self-disclosed this via Dell Security Advisory DSA-2026-096, indicating a confirmed code-level flaw.

OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.

OS command injection in the Cudy WR3000 2.0 router allows an authenticated network attacker to execute arbitrary commands with root privileges by exploiting the mesh MQTT command interface. The sync_command binary passes unsanitized attacker-controlled input directly to a shell execution sink in command.lua, and the vulnerable command execution path is enabled by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and root-level impact make this a high-priority patch target for any deployment using the mesh networking feature.

Command injection in Renovate's gleam manager (versions 39.53.0 through 40.33.0 exclusive) allows attackers with repository write access to execute arbitrary OS commands on the machine running Renovate by committing a crafted gleam.toml containing shell metacharacters in dependency names. The depName field sourced from gleam.toml is interpolated directly into a gleam deps update shell invocation without using shlex quoting, enabling full shell escape. A detailed proof-of-concept is publicly documented in the GHSA advisory (GHSA-xjr7-3c3g-m763); no confirmed active exploitation appears in CISA KEV at time of analysis.

Command injection in Renovate's helmv3 manager (versions 31.51.0 through 40.32.x) allows repository contributors with write access to execute arbitrary OS commands on the system running Renovate by embedding shell metacharacters in the `repository` field of a crafted `Chart.yaml` file. The unsanitized value is interpolated directly into a `helm registry login` shell invocation without applying `shlex.quote()` escaping. A detailed proof-of-concept demonstrating process termination via `kill 1` is publicly documented in GHSA-3f44-xw83-3pmg; no public exploit identified at time of analysis beyond the POC, and CISA KEV does not list this CVE.

Command injection in Renovate's hermit manager (versions 32.135.0 through 40.33.0) allows an attacker with repository write access to execute arbitrary commands on the machine running Renovate by supplying a maliciously named hermit dependency. The root cause is the unsanitized concatenation of user-controlled `depName` values directly into `./hermit install` and `./hermit uninstall` shell commands in `lib/modules/manager/hermit/artifacts.ts`. A detailed proof-of-concept is publicly available in GitHub Security Advisory GHSA-36j9-mx87-2cff; no confirmed active exploitation or CISA KEV listing exists at time of analysis.

Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write access to execute arbitrary commands on the CI/CD host running Renovate by supplying malicious `packageName` values via a crafted `renovate.json5` configuration file. The root cause is in `lib/modules/manager/npm/post-update/npm.ts`, where user-controlled package names and workspace keys are interpolated directly into shell commands during lock file maintenance without shell escaping via `shlex.quote()`. A working proof of concept is publicly available in the official GitHub Security Advisory (GHSA-fr4j-65pv-gjjj), and a vendor-released patch exists in version 40.33.0; no confirmed active exploitation has been reported at time of analysis.

Command injection in Renovate's kustomize manager (versions 39.218.0 through 40.33.0) allows repository contributors with write access to execute arbitrary shell commands on the Renovate host machine by embedding crafted chart names in `kustomization.yaml` files that bypass shell escaping in `helm pull` invocations. A detailed proof-of-concept demonstrating process termination via `kill 1` against a Docker-hosted Renovate runner was published with GHSA-xv56-3wq5-9997, confirming exploitability - though no confirmed active exploitation (CISA KEV) has been observed. Exploitation is constrained by the requirement for both repository write access and the non-default `kustomizeInflateHelmCharts` postUpdateOption.

Command injection in Renovate's Gradle Wrapper update mechanism allows arbitrary code execution inside the Renovate runtime when the tool processes a repository containing a malicious `gradle-wrapper.properties`. Versions >= 32.124.0 and < 42.68.5 of renovatebot/renovate (and Mend renovate-ce/renovate-ee before 13.3.0) are affected whenever Renovate performs Gradle Wrapper artifact handling. An attacker who can introduce a crafted `distributionUrl` containing `$(...)` shell substitution into a scanned repository gains arbitrary command execution as the Renovate process, potentially exfiltrating CI/CD tokens, repository credentials, and internal network resources; a proof-of-concept screen recording demonstrating `/etc/passwd` exfiltration exists, and no public exploit identified at time of analysis for CISA KEV status.

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using a single-character kwarg combined with split_single_char_options=False, causing git's short-option parser to interpret a smuggled joined token as --upload-pack=<cmd>. This is a second-order incomplete-fix bypass of the previously patched GHSA-r9mr-m37c-5fr3, affecting all guarded methods including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. A working proof-of-concept is publicly available in the upstream GitHub Security Advisory GHSA-wvpp-8hx9-p66j; no CISA KEV listing is present at time of analysis, but the public PoC significantly lowers the exploitation bar.

Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.

Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.

OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.

Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in Blueprint Studio before 2.5.2 allows authenticated Home Assistant users to execute arbitrary shell commands with Home Assistant's OS-level privileges by embedding newline characters or shell metacharacters into configured Git credential values. The vulnerable code in git_manager.py interpolated raw username and token values directly into generated shell credential helper scripts without any sanitization or validation. The fix, released in version 2.5.2 on 2026-05-26, adds input validation rejecting credentials containing newlines or null bytes and simultaneously restricts the entire Blueprint Studio backend API to admin-only users - no public exploit has been identified at time of analysis.

Arbitrary OS command execution in Super Productivity's Electron desktop app (versions prior to 18.13.0) allows any community plugin or renderer-accessible script to invoke `child_process.exec()` with the user's desktop account privileges via the unguarded `window.ea.exec()` IPC bridge, completely bypassing the `nodeExecution` permission gate that protects the sanctioned script-execution path. The attack surface is broader than a typical plugin vulnerability: JavaScript plugins execute via `new Function()` in the host renderer context, and iframe plugins run with `allow-same-origin`, granting direct `window.parent.ea` access - meaning no postMessage bridge filtering applies. A confirmation dialog exists but is undermined by a persistence checkbox pre-selected by default, enabling silent command re-execution on all subsequent invocations. No public exploit or CISA KEV listing has been identified; the issue is resolved in 18.13.0 by complete removal of the exec IPC handler.

Remote code execution in LibreNMS allows an authenticated administrator to execute arbitrary OS commands on the host server by chaining two unsafe PHP `exec()` calls in the Signal alert transport module. Versions 21.6.0 through 26.5.0 (exclusive) are affected, with the root cause being unescaped user-controlled inputs - the `signal-cli` path and `Recipient` field - interpolated directly into shell commands in `LibreNMS/Alert/Transport/Signal.php` and `scripts/composer_wrapper.php`. A publicly available proof-of-concept with step-by-step exploit instructions is included in the GitHub Security Advisory GHSA-c9fv-cgmm-2wg7; no CISA KEV listing was identified at time of analysis.

Command injection in Microsoft Copilot Web (copilot_web) enables unauthenticated remote attackers to exfiltrate sensitive data over the network by embedding malicious command elements in user-controlled input. The impact is strictly bounded to confidentiality - no integrity or availability loss - and a proof-of-concept is publicly available on GitHub. Despite a CVSS 7.5 score and public PoC, SSVC classifies exploitation as none with Automatable=no, and EPSS sits at 1.63%, suggesting limited real-world exploitation activity at time of analysis.

Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.

OS command injection in the COMFAST CF-N1-S 2.6.0.1 router's CGI interface enables network-accessible, authenticated attackers to execute arbitrary operating system commands by manipulating the `ssid` parameter at the `/cgi-bin/mbox-config?method=SET&section=ptest_ssid` endpoint. The underlying function `sub_44B438` passes unsanitized user input directly to a shell, resulting in full device compromise with scope impact extending to downstream network systems. A public proof-of-concept exploit has been published, classified under CWE-77 (Command Injection), and no vendor patch has been identified at time of analysis.

Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.

Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly suppresses shell operator interpretation in AMP module commands but fails to do so for on-alert action commands in `glances/actions.py`, where `secure_popen()` is called without `allow_operators=False`. An attacker with write access to `glances.conf` can place shell metacharacters (`>`, `&&`, `|`) in alert action directives, which execute at the Glances process privilege when an alert threshold is crossed - despite the operator supposedly operating in hardened mode. No public exploit confirmed active exploitation (no CISA KEV listing); a benign proof-of-concept is documented in GHSA-59fj-m2j6-hcxh. The fix is available in Glances 4.5.6.

Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execution rights to bypass the action-template sanitizer by embedding pipe characters in process argv, which is exposed as a Python list that the incomplete `_sanitize_mustache_dict()` function passes to the Mustache renderer without sanitization. This is a confirmed incomplete fix of CVE-2026-32608: the original sanitizer checked only top-level string values in the render dictionary, leaving nested containers unchecked, and the Chevron renderer does not escape `|`, so the character reaches `secure_popen` and spawns an attacker-controlled subprocess. Vendor-released patch v4.5.6 introduces recursive sanitization; no public exploit has been identified at time of analysis.

Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when administrator-configured action templates use adjacent unescaped Mustache variables. The per-field sanitizer in _sanitize_mustache_dict() strips multi-character shell operators from individual template field values but cannot prevent their reconstruction across variable boundaries after Chevron rendering, enabling '&&' to be assembled from two separate '&' characters that each pass the filter individually and are then executed by secure_popen(). No public exploit has been identified at time of analysis, though GHSA-qcpp-8x79-hhp3 provides sufficient technical detail to reproduce the attack technique.

Remote code execution in JetBrains IntelliJ IDEA before version 2026.2.1 is achievable through the Markdown export tool via OS command injection. An attacker who can deliver a crafted Markdown file to a developer and induce them to export it can execute arbitrary operating system commands in the context of the IntelliJ IDEA process. No public exploit or CISA KEV listing has been identified at time of analysis, but the CWE-78 root cause and full C/H/I/H/A:H impact make this a meaningful risk for development workstation environments.

Shell command injection in openshift-metal3/fakefish allows low-privileged network-accessible attackers to execute arbitrary OS commands by supplying crafted Image URLs or BMC credential values. Unquoted shell variable expansion in FakeFish scripts passes attacker-controlled strings directly into shell command lines and Kubernetes manifests without sanitization, with the Changed scope (S:C) in the CVSS vector indicating impact extends beyond the FakeFish process to the underlying provisioning infrastructure. No public exploit code has been identified at time of analysis, and no active exploitation is recorded in CISA KEV.

OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.

OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.

Arbitrary command execution in the conflibot GitHub Action (versions before 1.2.1) lets any user who opens a pull request run shell commands on the workflow runner. conflibot builds git commands via string interpolation and executes them through a shell, and one interpolated value is the attacker-controlled PR head branch name (head.ref); a branch name containing shell metacharacters is executed as code. Under the documented pull_request_target configuration the runner holds a write-scoped GITHUB_TOKEN and repository secrets, so this is a critical CI/CD supply-chain exposure (CVSS 9.1). There is no public exploit identified at time of analysis, but the technique is well understood and the trigger is trivial.

LDAP filter injection in Roundcube Webmail arises from unescaped substitution variables (`%u`, `%fu`, `%d`) embedded directly into LDAP `search_filter` configuration strings, affecting all 1.6.x releases before 1.6.18 and 1.7.x releases before 1.7.3. An authenticated user whose login credentials contain crafted LDAP metacharacters can manipulate server-side directory queries, potentially disclosing LDAP directory contents or escalating privileges by subverting group membership lookups. No active exploitation has been identified at time of analysis (SSVC: Exploitation none), though the low attack complexity and network accessibility warrant prompt patching for any LDAP-backed deployment.

IMAP command injection in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 enables authenticated remote attackers to disclose information or escalate privileges by exploiting a desynchronization between mail search operations and LITERAL+ byte-count handling. The flaw was reported by Zach Hanley of Horizon3.ai and is classified as CWE-77 (Command Injection), with the vendor releasing patched versions 1.6.18 and 1.7.3 on 2026-08-09. No public exploit code or CISA KEV listing has been identified at time of analysis, though the C:H/I:H CVSS impact and the researcher's track record for producing working exploits elevate the urgency of patching.

Remote code execution in Roundcube Webmail (before 1.6.18 and 1.7.x before 1.7.3) is achievable by authenticated remote attackers through the cmd_learn driver of the markasjunk plugin, which passes unsanitized placeholder replacement values derived from user-controlled email content directly to OS command invocations (CWE-78). Exploitation is strictly limited to instances where the markasjunk plugin is installed and configured with the cmd_learn driver - a non-default, operator-configured setup - meaning the broader Roundcube population is unaffected. Vendor-released patches exist for both the 1.6.x and 1.7.x branches; no public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.

Local privilege escalation in SiYuan before 3.7.4 allows a low-privileged local attacker to execute arbitrary commands with administrator privileges by crafting a workspace directory whose path contains OS command metacharacters. When the victim triggers the Microsoft Defender exclusion workflow within SiYuan and approves the resulting UAC prompt, the application passes the unsanitized path to the elevated elevator.exe helper process, enabling command injection at administrator level. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.6 reflects the full-system compromise potential once the attack preconditions are met.

OS command injection in the Tenda W20E router firmware version 16.01.0.6(2782) allows remote attackers to execute arbitrary code by abusing the url_need_login function, which fails to sanitize attacker-controlled input before passing it to a system shell (CWE-78). The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, meaning unauthenticated network-based exploitation with full compromise of the device. Publicly available exploit code exists via a GitHub disclosure repository, though EPSS remains low (0.21%) and it is not listed in CISA KEV.

OS command injection in @ooples/token-optimizer-mcp v5.0.1 and earlier allows any MCP client that can call the smart_user tool to execute arbitrary shell commands with the privileges of the MCP server process. The get-user-info operation interpolates the caller-controlled username argument directly into a shell command string passed to Node.js execAsync(), and the double-quoting applied by the developer does not prevent POSIX shell command substitution via $(...) or backtick syntax. A complete, working proof-of-concept is publicly available via GHSA-49mq-fc6q-3h46; no public exploit identified at time of analysis as actively exploited per CISA KEV, though the low exploitation complexity makes this a high-priority patching target.

Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute arbitrary shell commands on the Semaphore server host by injecting git arguments through a crafted repository git_url value. The root cause (CWE-88, Argument Injection) lies in the default cmd_git client passing user-supplied input unsanitized to the system git binary, enabling exploitation via git's --upload-pack= option to specify an arbitrary server-side command. No public exploit code has been confirmed at time of analysis, but the --upload-pack argument injection technique is extensively documented in open-source security research and requires no specialized tooling for any holder of the requisite project role.

Command injection in Microsoft PowerShell 7.4, 7.5, and 7.6 allows a locally authenticated attacker with standard user privileges to execute arbitrary code on the affected system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local access and a low-privileged account - no elevated rights, user interaction, or complex conditions are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the bar for exploitation once an injection point is discovered.

Command injection in Cockpit CMS 2.14.0 and earlier allows any authenticated user holding only the assets/upload permission to execute arbitrary OS commands as the web-server user. The FFmpeg integration passes the raw, user-controlled upload filename directly into Process::fromShellCommandline() before slug sanitization runs, meaning shell metacharacters - backticks, $(), semicolons - in the filename escape the FFmpeg invocation context. No public exploit has been identified at time of analysis, but the fix is confirmed in upstream commit 28813596f57685f63d3a48f655e8e9bd2b535cab, which migrates all FFmpeg invocations from shell-interpolated command strings to argument-array Process construction.

Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Language commands on the IBM i host because special elements in a command are not properly neutralized (CWE-78). The CVSS 3.1 base score is 9.8 with a fully network-facing, no-privilege, no-interaction vector, meaning an unauthenticated remote attacker can achieve high-impact code execution. There is no public exploit identified at time of analysis and EPSS is modest at 0.47% (39th percentile), but the combination of unauthenticated network reach and full CIA impact makes this a high-priority patch.

Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.

Remote unauthenticated OS command injection in the Haiwell IoT Cloud HMI Gateway (version 3.40.1.12) lets attackers run arbitrary operating-system commands as root through the 'Net Check' function's cmdPing Socket.io event on the /setting endpoint. The CVSS 3.1 base score is 10.0 with a scope change, reflecting full compromise of the device with no authentication or user interaction. No public exploit has been identified at time of analysis, and the flaw is documented in CISA ICS advisory ICSA-26-225-02.

OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it.

Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.

Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.

Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Tenable self-reported this via vulnreport@tenable.com and published advisory TNS-2026-22.

Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

OS command injection in the Baicells EG3661M LuCI web interface (firmware BaiCE_BQ6_2.0.5.3_NA) allows an authenticated remote attacker with administrative credentials to execute arbitrary operating system commands by manipulating the MaxHops, Timeout, or Size arguments passed to /cgi-bin/luci. Full confidentiality, integrity, and availability compromise of the device is achievable upon exploitation. A public proof-of-concept exploit is available on GitHub, and no vendor patch exists - the vendor did not respond to responsible disclosure, leaving affected deployments with no official remediation path.

OS command injection in OpenChoreo's Workflow Plane templates allows authenticated developers to execute arbitrary shell commands inside workflow pods by supplying malicious workflow parameters. Affected versions prior to 1.0.4, 1.1.4, and 1.2.0-rc.2 directly interpolated user-controlled parameters such as image-name, image-tag, app-path, and build-env into sh -c shell text rather than passing them through container.env, a classic CWE-78 pattern. Compounding the injection risk, affected privileged Podman templates lacked the hostUsers: false isolation setting, creating a credible path from workflow pod compromise to Kubernetes node-level impact. No public exploit has been identified at time of analysis, but the fix commits confirm the vulnerability mechanism.

Arbitrary OS command injection in FreePBX Music on Hold module versions 17.0.1 through 17.0.6 allows an authenticated administrator to execute commands as the asterisk service user by supplying dangerous player arguments through the custom application configuration interface. The validateCustomConfiguration() function in Music.class.php accepted player command-line options for mpg123, mpg321, madplay, ogg123, and cvlc without blocking file-write, FIFO, or network control flags, because the applicationUsesDisallowedPlayerOption() function lacked the blocklist logic needed to reject them. No public exploit code or active exploitation has been identified at time of analysis; the issue is patched in version 17.0.7.

Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote unauthenticated attacker to execute arbitrary OS commands on affected devices. The vulnerable function CAte::HandleCmd in the Kylin binary fails to sanitize user-supplied input before passing it to a system command interpreter (CWE-77), granting full device compromise. A proof-of-concept exists on GitHub (E:P in the CVSS 4.0 supplemental metrics) and no KEV listing is present at time of analysis, though the unauthenticated network vector and PoC availability elevate near-term exploitation risk.

Remote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute arbitrary operating system commands as the Zimbra service account by sending specially crafted SMTP requests that trigger unsanitized input processing in the SNMP notification subsystem. Exploitation is conditional on the non-default zimbra-snmp package being installed and SNMP notifications being enabled, which meaningfully narrows the exposed population despite the CVSS 8.9 score. No public exploit code and no CISA KEV listing were identified at time of analysis.

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection - that let an attacker who controls hostnames, hostspecs, or related input inject shell metacharacters or newlines and run commands as the rsync process or invoking user. VulnCheck reported the cluster of CWE-78 flaws, which are fixed together in the major security release v3.5.0. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the CVSS 4.0 base score of 9.2 reflects full confidentiality, integrity, and availability impact.

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation logic inspects kwarg keys but never their values, allowing an attacker to smuggle dangerous git options such as --upload-pack inside single-character kwarg values across every guarded method - clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. Any application that passes externally-influenced kwargs to these methods is fully compromised; the attacker achieves arbitrary OS command execution as the host process. A working proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing has been issued at time of analysis.

Arbitrary OS command execution in GitPython <= 3.1.53 is achievable during clone operations because the `unsafe_git_clone_options` denylist in `base.py` omits `--template`, allowing it to pass `check_unsafe_options` without error in the default `allow_unsafe_options=False` configuration. Callers who can influence `Repo.clone_from()` arguments can supply a `--template` path to an attacker-staged directory containing an executable `post-checkout` hook, which git automatically executes at checkout time. A live-verified proof-of-concept against tag 3.1.53 has been publicly disclosed; no active exploitation is confirmed in CISA KEV at time of analysis.

Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScript sandbox by abusing the /api/v1/node-custom-function endpoint. By passing attacker-controlled executablePath and args into puppeteer.launch(), the code reaches child_process.spawn() outside the sandbox, yielding arbitrary OS command execution as the Flowise process user (root in the official Docker image) and host file disclosure via Chromium's file:// handling. No public exploit is identified at time of analysis, but a vendor security advisory (GHSA-9gvv-qjj3-2p6g) and VulnCheck confirm the flaw; the CVSS 4.0 base score is 9.4.

Unauthenticated superuser takeover in UpSnap 4.4.1 through 5.3.5 lets a network attacker seize an un-provisioned instance by calling POST /api/upsnap/init-superuser, which is guarded only by a totalSuperusers > 0 check that is always false on a fresh install. After registering the first admin and obtaining a long-lived JWT, the attacker abuses UpSnap's device wake/shutdown command feature to reach exec.CommandContext("/bin/sh","-c", ...) and execute shell commands as the server user (root in typical container deployments). No KEV listing and no public exploit identified at time of analysis; the fix is in 5.4.0.

Authenticated remote code execution in UpSnap (a self-hosted Wake-on-LAN web app) before 5.4.0 lets any low-privileged user with device create/edit permission run arbitrary OS commands on the server. User-supplied device IP and MAC values are interpolated into the wake_cmd/shutdown_cmd shell templates and passed unsanitized to /bin/sh -c on Linux or cmd /C on Windows, giving full command execution in the app's process context. No public exploit was identified at time of analysis and it is not in CISA KEV, but the flaw is trivially triggerable at low attack complexity once an account exists; a companion setup-wizard flaw (GHSA-w4jr-728f-5jhq) can let an attacker seize the first superuser on un-provisioned public instances and chain into this RCE.

Remote unauthenticated OS command injection in IBM Informix Dynamic Server 12.10, 14.10, and 15.0 allows network-accessible attackers to execute arbitrary system commands under the Informix service account without any credentials or user interaction. Rooted in CWE-78, the flaw arises from insufficient validation of user-supplied input before it is passed to OS-level execution routines, spanning three major version branches of the product. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; a vendor patch is available via the IBM advisory.

OS command injection in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 enables a local attacker to execute arbitrary code on the underlying operating system. Exploitation requires user interaction (UI:R) but no prior privileges (PR:N), suggesting the attack vector involves a maliciously crafted file or input that a victim opens or processes with the client application. IBM has released a patch via advisory node/7282954, and no public exploit or CISA KEV listing has been identified at time of analysis.

OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-privileged administrators to execute arbitrary operating system commands beyond their intended scope by submitting crafted HTTP requests to the vulnerable endpoint. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2, IBM Verify Identity Access 11.0-11.0.3, and the containerized variant of the latter - covering both legacy on-premises and modern container-based identity infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full confidentiality, integrity, and availability impact against identity management infrastructure elevates organizational risk well beyond what the PR:H prerequisite might suggest at face value.

OS command injection in IBM i 7.3 through 7.6 allows a remote authenticated attacker to execute arbitrary operating system commands with the privileges of the affected service. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), covering all four current IBM i release lines. No public exploit or CISA KEV listing has been identified at time of analysis, but the high CVSS score of 8.8 and full CIA impact triad reflect serious post-authentication risk on a platform commonly used for enterprise workloads.

Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows an attacker-controlled argument to break out of a parenthesized cmd.exe construct and inject arbitrary shell syntax on Windows. The flaw affects applications that call the escape or escapeAll APIs with shell set to cmd.exe (or shell:true when CMD is the default), because getEscapeFunction in src/internal/win/cmd.js failed to escape the ( and ) characters. A working proof-of-concept payload is published in the vendor advisory; there is no CISA KEV listing and no evidence of active exploitation at time of analysis.

Remote command injection in IBM i 7.3 through 7.6 allows a network-accessible authenticated attacker to execute arbitrary OS commands by supplying shell metacharacters in unsanitized input, resulting in full confidentiality, integrity, and availability compromise of the affected system. IBM confirmed and patched this vulnerability, documented at https://www.ibm.com/support/pages/node/7283275. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication bar make this a credible threat to any internet-exposed IBM i environment.

Command injection in stata-mcp (pip:stata-mcp < 1.19.0) enables full OS-level remote code execution against any principal that can invoke the `ado_package_install` MCP tool. The `package` argument is concatenated unsanitized into a Stata command string delivered via pexpect.sendline(), allowing embedded newline characters to inject arbitrary Stata commands - including the `shell` escape - that execute under the account running the MCP server. Because the tool is registered in the default `all` profile and `all` is the active default, no misconfiguration by the victim is required; a detailed proof-of-concept confirmed via Docker reproduction is publicly available in the GitHub advisory, and a vendor-released patch exists in v1.19.0.

Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.

OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execute arbitrary operating-system commands on the affected IBM i host by injecting unneutralized special characters into a command the product builds and runs. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact and a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but a vendor patch is available and the low attack complexity makes this a high-priority fix.

Remote OS command injection in IBM i 7.5 and 7.6 enables authenticated attackers with low-privilege network access to execute arbitrary commands with elevated system privileges, resulting in complete compromise of confidentiality, integrity, and availability. The flaw (CWE-78) arises from improper neutralization of special characters passed to OS command processing functions without adequate sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and network-accessible attack surface make this a high-priority remediation target for any IBM i deployment.

OS command injection in IBM i 7.5 and 7.6 enables a local attacker holding low-level credentials to escalate privileges to a highly elevated system authority level by injecting shell metacharacters into an unsanitized OS command interface (CWE-78). Both release streams - 7.5 and 7.6 - running on IBM Power Systems hardware are confirmed affected per the IBM advisory. IBM has released a patch via their support portal; no CISA KEV listing and no public exploit code have been identified at time of analysis.

IBM i versions 7.3 through 7.6 expose arbitrary Control Language (CL) command execution to remote authenticated attackers through insufficient input validation in a network-accessible interface. Any low-privileged IBM i user account is sufficient to exploit this flaw, enabling high-impact compromise of confidentiality and integrity on the affected system. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad version range across currently supported IBM i releases make this a meaningful patching priority for affected enterprises.

Privilege escalation via OS command injection in IBM i Navigator for i (versions 7.3 through 7.6) allows any authenticated, low-privileged network user to execute arbitrary OS commands as the root user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms this is a low-complexity, network-accessible exploit requiring only a valid user account - no additional privileges or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full CIA impact make this a genuine remediation priority for IBM i environments.

Remote code execution in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows authenticated UI users to run arbitrary OS commands as the nagios system user by injecting shell metacharacters through the com_data parameter when notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-executed positions. The vulnerability is classified as CWE-78 (OS Command Injection) and reported by VulnCheck; vendor-released patches are now available for both product lines. No public exploit identified at time of analysis, and exploitation is bounded by a non-default notification command configuration requirement reflected in the CVSS 4.0 AT:P metric.

Authenticated remote code execution in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) is achievable via OS command injection through custom-variable macros processed by the Nagios Remote Data Processor (NRDP). An attacker with valid NRDP access can embed shell metacharacters in a custom variable value that is later expanded inside a shell-executed command definition, causing arbitrary OS commands to run with the privileges of the Nagios process. No public exploit code or CISA KEV listing exists at time of analysis, but impact is rated high across confidentiality, integrity, and availability given full command execution on the monitoring server.

Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve OS command execution on the server by supplying a repository git_url beginning with a dash (e.g. --upload-pack=/tmp/evil.sh). The malicious URL is passed as a positional argument to the git binary via CmdGitClient.GetLastRemoteCommitHash, triggered both by POST /api/project/{id}/repositories and by scheduled commit-hash polling, so exploitation can fire automatically without further attacker action. No public exploit identified at time of analysis, though the fixing commits and a detailed GHSA advisory publicly document the mechanism.

Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management access run arbitrary shell commands on the shared backend worker. The Kubernetes provider's connection test accepted a kubeconfig containing a legacy GCP auth-provider with cmd-path/cmd-args, which the kubernetes-python client executed via subprocess when POST /api/v1/providers/{id}/connection loaded it. No public exploit is identified at time of analysis, but the flaw is fixed in 5.36.0 and carries a critical 9.9 CVSS.

Remote code execution in the archived Cloudflare pages-action GitHub Action (src/index.ts) allows network-adjacent attackers to exfiltrate CI/CD secrets - including CLOUDFLARE_API_TOKEN and GITHUB_TOKEN - from affected workflow runner environments. All published versions of cloudflare/pages-action are affected, and Cloudflare has confirmed no patch will be issued because the repository has been deprecated since 2024 and is scheduled for removal on 2026-09-18. No public exploit code has been confirmed at time of analysis, but the vulnerability was discovered and reported through Cloudflare's HackerOne program by external researchers.

Shell command injection in libgit2's SSH libssh2 backend (v0.27.0-v1.9.0) enables remote attackers to execute arbitrary commands on an SSH server by embedding unescaped shell metacharacters in a submodule URL. An attacker who controls a repository's .gitmodules file can induce arbitrary SSH server-side code execution under the victim's SSH user account when the victim performs a recursive clone using a libgit2-based client built with the libssh2 backend. No public exploit has been identified at time of analysis and SSVC assessment records no active exploitation, but CVSS 4.0 scores this 8.6 and technical impact is rated total.

Remote code execution in FileRun ≤2026.2.0 is achievable by any authenticated user who can upload files, exploiting a shell command injection flaw in the thumbnail generation pipeline. The subsystem passes uploaded filenames wrapped in double-quotes directly to exec() without escapeshellarg() sanitization, meaning filenames such as $(PAYLOAD).mp4 survive the filename sanitizer and are evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the upload. Vendor-released patch 2026.2.1 is available; no CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity, authenticated-only barrier makes this a high-priority patch target for any FileRun deployment.

Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target.

Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbitrary OS commands on a connecting user's machine. The root cause is server-controlled folder names being interpolated without quote-escaping into shell commands — both `du -sh '${folder}'` in `src/app/lib/fs.js` and equivalent calls in `src/client/components/sftp/file-info-modal.jsx` — allowing a crafted single-quote-bearing folder name to break out of the intended shell quoting context. No public exploit has been identified at time of analysis; a vendor-released patch exists in v3.15.120.