cve.bz

CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection), page 5

Filter

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

What the weakness is: CWE-88 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 5
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads Likelihood: High · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-137 Parameter Injection Likelihood: Medium · Severity: Medium
  • CAPEC-174 Flash Parameter Injection Likelihood: High · Severity: Medium
  • CAPEC-460 HTTP Parameter Pollution (HPP) Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-88, as MITRE names them. Credits.

Ask an AI about CWE-88

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-88: Improper Neutralization of Argument Delimiters in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/88.html and https://cve.bz/cve/cwe/88?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.0CVE-2026-4519EPSS 0.3%

    The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to we…

  2. 5.4CVE-2026-29608EPSS 0.1%

    OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended cod…

  3. 7.1CVE-2026-22168EPSS 0.4%

    OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign…

  4. 9.8CVE-2026-32304EPSS 0.6%

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, a…

  5. 6.8CVE-2026-1717EPSS 0.2%

    An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges.

  6. 6.9CVE-2026-1716EPSS 0.2%

    An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges.

  7. 6.9CVE-2026-1715EPSS 0.2%

    An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges.

  8. 6.5CVE-2026-25689EPSS 0.6%

    An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDecep…

  9. 7.8CVE-2025-41761EPSS 0.2%

    A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump…

  10. 2.1CVE-2026-3682EPSS 0.3%

    A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. This vulnerability affects the function Execute of the file /internal/service/ffmpeg/ffmpeg.go. The manipulation leads to argument injection. The attack may be …

  11. 8.8CVE-2026-26194EPSS 0.5%

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options g…

  12. 6.7CVE-2026-20016EPSS 0.4%

    A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-l…

  13. 6.0CVE-2026-20063EPSS 0.2%

    A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid admi…

  14. 7.5CVE-2026-26514EPSS 0.5%

    An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q par…

  15. 9.4CVE-2026-27947EPSS 0.8%

    Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnera…

  16. 10.0CVE-2026-27613EPSS 0.9%

    TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server config…

  17. 7.8CVE-2026-27208EPSS 0.7%

    bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privi…

  18. 9.8CVE-2025-70327EPSS 0.8%

    TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through Cst…

  19. 9.1CVE-2026-24126EPSS 0.5%

    Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. …

  20. 7.8CVE-2025-15316EPSS 0.1%

    Tanium addressed a local privilege escalation vulnerability in Tanium Server.

  21. 7.8CVE-2025-15315EPSS 0.1%

    Tanium addressed a local privilege escalation vulnerability in Tanium Module Server.

  22. 9.4CVE-2026-25134EPSS 0.9%

    Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a syst…

  23. 9.2CVE-2025-24293ExploitEPSS 5.6%

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three meth…

  24. 6.3CVE-2026-24739EPSS 0.2%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, the Symfony Process component did not correctly treat some characters (notably `=…

  25. 7.8CVE-2025-61731EPSS 0.6%

    Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to t…

  26. 9.8CVE-2026-22583EPSS 0.6%

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud …

  27. 9.8CVE-2026-22582EPSS 0.6%

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud E…

  28. 8.8CVE-2026-0774EPSS 0.8%

    WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchYourLAN. Authentication is not require…

  29. 9.8CVE-2026-24061KEVExploitEPSS 99%

    telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

  30. 7.0CVE-2025-67858EPSS 0.2%

    A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Fo…

  31. 6.9CVE-2025-66002EPSS 0.2%

    An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper

  32. 4.8CVE-2025-14946EPSS 0.1%

    A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectl…

  33. 6.3CVE-2025-68144EPSS 7.2%

    In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) wo…

  34. 6.6CVE-2025-62847EPSS 0.8%

    An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have alr…

  35. 8.7CVE-2024-58275EPSS 1.8%

    Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary com…

  36. 8.8CVE-2025-12613EPSS 0.4%

    Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead t…

  37. 8.7CVE-2025-12556EPSS 0.5%

    An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machine.

  38. 6.7CVE-2025-36565EPSS 0.2%

    Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contai…

  39. 6.5CVE-2025-43905EPSS 0.3%

    Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7…

  40. 7.4CVE-2025-59489EPSS 0.6%

    Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the…

  41. 8.2CVE-2025-59937EPSS 0.5%

    go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO command…

  42. 5.3CVE-2025-59433EPSS 0.2%

    Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests w…

  43. 8.6CVE-2025-47421EPSS 0.4%

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A spe…

  44. 7.8CVE-2025-43730EPSS 0.2%

    Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A local unauthenticated user could potentially exploit this vulnerability leading…

  45. 6.9CVE-2025-57791ExploitEPSS 39%

    A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user se…

  46. 8.5CVE-2025-6232EPSS 0.2%

    An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations.

  47. 8.5CVE-2025-6231EPSS 0.2%

    An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file.

  48. 7.1CVE-2025-53509EPSS 0.3%

    A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used dire…

  49. 7.1CVE-2025-52459EPSS 0.3%

    A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters can be used directly …

  50. 7.7CVE-2025-53542EPSS 0.6%

    Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of N…