An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
CVE-2026-101076 is a critical OS command injection vulnerability in Netcore NR289-GE version 1.4.5102. It affects the system function in the /set_ntp_server_ip.cgi CGI Handler component, allowing remote attackers to inject OS commands via the ntp_ip argument. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.
Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.
CVE-2026-78424 is an OS command injection vulnerability in SUSE NeuVector affecting versions before 5.4.11, 5.5.4, and 5.6.2. It allows authenticated users with specific write permissions or access to internal gRPC certificate keys to execute arbitrary OS commands in a privileged container, potentially compromising the entire worker node. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-91006 is an OS command injection vulnerability in Apache Karaf's instance-management service. The vulnerability arises because the javaOpts parameter is concatenated into a shell command without proper quoting, allowing shell metacharacters to be interpreted by the OS shell. This can lead to arbitrary command execution with the privileges of the Karaf process user. The flaw is reachable via several Karaf shell commands and JMX operations related to instance management. Mitigations include restricting access to these commands and treating javaOpts as untrusted input unless from fully trusted operators.
CVE-2026-100382 is a critical OS Command Injection vulnerability in the Wikimedia Foundation's Mediawiki ExternalData Extension. It affects all versions prior to 3.7. The flaw allows improper neutralization of special elements used in OS commands, potentially enabling remote attackers to execute arbitrary OS commands without authentication.
CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as `AlastairLundy.CliInvoke.Specializations` versions 1.0.0-rc.1 through 1.6.1.1, contain an OS command injection vulnerability in their PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to `pwsh -Command` or `cmd /c` using a single `ProcessStartInfo.Arguments` string, allowing a double quote in untrusted input to break operating-system-level quoting and cause the shell to execute an additional command with the host process's privileges. The vulnerability is patched in `CliInvoke.Specializations` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.1, and in `AlastairLundy.CliInvoke.Specializations` version 2.0.2. No complete workaround is available; users unable to upgrade should reject or remove double quotes from target paths and arguments, additionally reject shell metacharacters in versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, or bypass the PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input.
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.
The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.
Root Browser Classic version 3.3.0 contains an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements when passing a SQLite database path to the operating system shell. This flaw allows an attacker to execute arbitrary OS commands by manipulating the input path. The vulnerability has a high severity score of 8.5 and requires user interaction to exploit. No official patch or remediation guidance is currently provided.
Eufy Omni C20 devices prior to versions 1.4.6 and 3.1.36 are vulnerable to an OS command injection flaw during the pairing process. This vulnerability allows an unauthenticated attacker to execute arbitrary system commands, posing a critical security risk. The issue is identified as CWE-78 and has a CVSS 4.0 base score of 9, indicating high severity. The vulnerability has been fixed in versions 1.4.6 and 3.1.36.
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.
CVE-2026-79761 is an OS command injection vulnerability in Termix-SSH's Termix platform affecting versions from 1.7.0 up to but not including 2.5.1. The issue arises in the SSH key deployment flow where user-controlled input is unsafely interpolated into shell commands, allowing an authenticated user with deployment privileges to execute arbitrary commands on the remote host. This vulnerability is fixed in version 2.5.1.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.