cve.bz

CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), page 20

Filter

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

What the weakness is: CWE-78 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-6 Argument Injection Likelihood: High · Severity: High
  • CAPEC-15 Command Delimiters Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-78, as MITRE names them. Credits.

Ask an AI about CWE-78

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-78: Improper Neutralization of Special Elements used in an OS Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/78.html and https://cve.bz/cve/cwe/78?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.1CVE-2026-19243EPSS 2.3%

    A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation …

  2. 7.3CVE-2026-48098EPSS 0.2%

    NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic.…

  3. 7.8CVE-2026-48097EPSS 0.2%

    NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on…

  4. 7.5CVE-2026-15816EPSS 0.4%

    A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_…

  5. 7.3CVE-2026-67434EPSS 1.1%

    PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblam…

  6. 8.6CVE-2026-63725EPSS 0.4%

    sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf …

  7. 9.8CVE-2026-15733ExploitEPSS 10%

    A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.

  8. 9.8CVE-2026-67261EPSS 2.3%

    Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability,…

  9. 9.3CVE-2026-53975EPSS 1.7%

    OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbat…

  10. 7.3CVE-2026-19036EPSS 3.2%

    A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched r…

  11. 7.3CVE-2026-19035EPSS 3.2%

    A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack …

  12. 7.3CVE-2026-19034EPSS 3.2%

    A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command inje…

  13. 8.0CVE-2026-71312EPSS 0.5%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeS…

  14. 5.0CVE-2026-66297EPSS 2.4%

    Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentC…

  15. 6.9CVE-2026-70611EPSS 0.2%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than…

  16. 8.8CVE-2026-17625EPSS 0.8%

    IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary …

  17. 8.8CVE-2026-17623EPSS 0.8%

    IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.

  18. 8.8CVE-2026-13477EPSS 0.5%

    IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user suppl…

  19. 7.2CVE-2026-71284EPSS 0.9%

    Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.sys…

  20. 7.8CVE-2026-16022EPSS 0.8%

    @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argu…

  21. 8.8CVE-2026-71243EPSS 0.5%

    The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting …

  22. 8.8CVE-2026-70375EPSS 1.9%

    HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured bra…

  23. 8.8CVE-2026-70374EPSS 1.9%

    HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail…

  24. 7.3CVE-2026-18900EPSS 3.8%

    A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated re…

  25. 9.8CVE-2026-66902EPSS 0.7%

    Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as …

  26. 8.7CVE-2026-16793EPSS 0.5%

    An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system com…

  27. 7.2CVE-2026-6837EPSS 1.5%

    A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on a…

  28. 9.8CVE-2026-52102EPSS 2.9%

    An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.

  29. 9.8CVE-2026-51190EPSS 1.9%

    The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user r…

  30. 8.6CVE-2026-67599EPSS 2.4%

    ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated di…

  31. 5.5CVE-2026-18641EPSS 2.7%

    A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the comp…

  32. 8.7CVE-2026-69096EPSS 3.3%

    OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus acce…

  33. 8.6CVE-2026-67608EPSS 2.4%

    Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands…

  34. 2.1CVE-2026-18590EPSS 1.8%

    A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to…

  35. 6.8CVE-2026-18587EPSS 2.0%

    A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be l…

  36. 8.7CVE-2026-67325EPSS 2.2%

    GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload…

  37. 9.3CVE-2026-67324EPSS 0.5%

    GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo…

  38. 9.3CVE-2026-67308EPSS 0.7%

    Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharac…

  39. 8.5CVE-2026-9044EPSS 2.5%

    An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN clie…

  40. 9.4CVE-2026-17566EPSS 0.7%

    pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (…

  41. 7.7CVE-2026-17347EPSS 0.7%

    The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous i…

  42. 7.2CVE-2026-16843EPSS 0.9%

    Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to a…

  43. 9.8CVE-2026-12943EPSS 0.8%

    IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privilege…

  44. 9.8CVE-2026-12940EPSS 0.9%

    IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util…

  45. 9.8CVE-2026-14522EPSS 1.0%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

  46. 8.8CVE-2026-22622EPSS 0.5%

    Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.

  47. 8.3CVE-2026-22621EPSS 0.6%

    Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.

  48. 8.5CVE-2026-44106EPSS 0.2%

    A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

  49. 8.5CVE-2026-44099EPSS 0.2%

    A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

  50. 8.8CVE-2026-44098EPSS 1.7%

    This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Chargin…