cve.bz

CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection), page 2

Filter

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

What the weakness is: CWE-88 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 5
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads Likelihood: High · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-137 Parameter Injection Likelihood: Medium · Severity: Medium
  • CAPEC-174 Flash Parameter Injection Likelihood: High · Severity: Medium
  • CAPEC-460 HTTP Parameter Pollution (HPP) Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-88, as MITRE names them. Credits.

Ask an AI about CWE-88

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-88: Improper Neutralization of Argument Delimiters in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/88.html and https://cve.bz/cve/cwe/88?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.4CVE-2026-100714EPSS 0.5%

    Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped int…

  2. 8.5CVE-2026-100570EPSS 0.1%

    OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content a…

  3. 8.6CVE-2026-100561EPSS 0.2%

    OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. A…

  4. 8.4CVE-2026-100369EPSS 0.4%

    CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `CliInvoke` versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.…

  5. 9.4CVE-2026-87900EPSS 0.7%

    Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

  6. 6.6CVE-2026-84724EPSS 0.3%

    An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defin…

  7. 9.9CVE-2026-84502EPSS 0.6%

    A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module …

  8. 8.5CVE-2026-75131EPSS 0.2%

    NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a craf…

  9. 3.1CVE-2026-71465EPSS 0.2%

    RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI opti…

  10. 3.1CVE-2026-71464EPSS 0.2%

    LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id a…

  11. 4.4CVE-2026-94588EPSS 0.2%

    In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package chan…

  12. 9.4CVE-2026-28197EPSS 0.7%

    An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions.…

  13. 9.4CVE-2026-54501EPSS 1.2%

    Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom…

  14. 8.5CVE-2026-93337EPSS 0.1%

    NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property …

  15. 1.0CVE-2026-55061EPSS 0.2%

    uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an …

  16. 8.7CVE-2026-89036EPSS 0.7%

    Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory par…

  17. 8.7CVE-2026-86864EPSS 0.6%

    pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options w…

  18. 7.1CVE-2026-86862EPSS 0.4%

    pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign into a full connection…

  19. 8.6CVE-2026-76866EPSS 0.6%

    Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanit…

  20. 8.7CVE-2026-76862EPSS 0.5%

    Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attacke…

  21. 9.8CVE-2026-54337EPSS 0.6%

    Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.

  22. 8.7CVE-2026-55887EPSS 0.2%

    MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server struct…

  23. 7.8CVE-2026-19624EPSS 0.1%

    A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can c…

  24. 6.9CVE-2026-90809EPSS 0.6%

    A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argume…

  25. 7.8CVE-2026-90894EPSS 0.2%

    Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlS…

  26. 2.7CVE-2023-22632EPSS 0.4%

    PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.

  27. 2.7CVE-2023-22631EPSS 0.4%

    PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.

  28. 6.3CVE-2026-90467EPSS 0.4%

    aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and a…

  29. 8.4CVE-2026-89066EPSS 0.2%

    Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integ…

  30. 3.3CVE-2026-11765EPSS 0.2%

    Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection. This issue affects Pardus Pen: before 4.2.1.

  31. 4.8CVE-2026-0304EPSS 0.3%

    A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.

  32. 8.6CVE-2026-8044EPSS 0.7%

    CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup…

  33. 7.1CVE-2026-87818EPSS 0.4%

    GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a…

  34. 8.6CVE-2026-87794EPSS 0.3%

    bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined …

  35. 5.0CVE-2026-78635EPSS 0.2%

    The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the under…

  36. 9.8CVE-2026-71377EPSS 0.6%

    Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-4…

  37. 7.7CVE-2026-84256EPSS 0.4%

    An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject

  38. 9.2CVE-2026-86060KEVExploitEPSS 6.4%

    RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requir…

  39. 8.7CVE-2026-85626EPSS 0.5%

    git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to…

  40. 7.1CVE-2026-74237EPSS 0.4%

    GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitiz…

  41. 6.5CVE-2026-79685EPSS 0.4%

    Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information.

  42. 7.1CVE-2026-55673EPSS 0.6%

    PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted…

  43. 7.1CVE-2026-54085EPSS 0.4%

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged s…

  44. 7.1CVE-2026-81529EPSS 0.3%

    Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builde…

  45. 8.6CVE-2026-80427EPSS 0.2%

    bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so a…

  46. 9.3CVE-2026-79675EPSS 0.8%

    NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or…

  47. 6.9CVE-2026-78637EPSS 0.4%

    A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file sr…

  48. 7.1CVE-2026-78678EPSS 0.4%

    GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers c…

  49. 9.3CVE-2026-78676EPSS 0.6%

    GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlin…

  50. 8.5CVE-2026-68766EPSS 0.2%

    hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attack…