Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle_read_install_pkg.c, libmport/delete_primative.c, and libexec/mport.create/mport.create.c. A local attacker with write access to a participating package cache or staging path could race path checks and replacement operations to redirect package downloads, cleanup, or install-related side effects outside the intended cache. The affected lifecycle helper paths also used shell-form invocation, increasing command-line interpretation risk during privileged helper execution. This issue is fixed in version 2.7.8.
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root.
The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.
Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.3 contains an OS Command Injection vulnerability (CWE-78). This flaw allows an unauthenticated remote attacker to execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 8.1. Exploitation requires remote network access but no privileges or user interaction. A fix is available in version 11.1.0.3.
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91100 is a medium-severity vulnerability in HP Linux Imaging and Printing Software (HPLIP) caused by improper neutralization of special elements in OS commands, leading to OS command injection. This vulnerability affects versions prior to 3.26.6. It could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. HP has identified and remediated multiple vulnerabilities in HPLIP, including this one.
SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralized by the active IRemotePathTransformation can execute commands as the authenticated SSH user. Exploitation requires a shell-based server and a path crafted for that shell's parsing rules; non-shell servers and paths fully neutralized by the selected transformation are not affected. RemotePathTransformation.ShellQuote is available for POSIX shells, while SftpClient avoids a remote shell entirely. This issue is fixed in version 2026.0.0.
Dell Update Package Framework versions prior to 26.07.03 contain an OS Command Injection vulnerability (CWE-78). This flaw allows a low privileged local attacker to execute arbitrary OS commands, potentially leading to elevation of privileges. The vulnerability is rated high severity with a CVSS score of 7.3. No official patch link is provided in the data, and the vendor advisory status is not confirmed. Exploits are not known to be active in the wild.
CVE-2026-73176 is a high-severity OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS devices. It affects firmware versions from 0 up to and including 1.06.01. A remote authenticated attacker can exploit this flaw by sending crafted request parameters to execute arbitrary OS commands with root privileges.
CVE-2026-73172 is a critical OS command injection vulnerability in the Advantech EKI-1242IEIMS device. It affects the edgserver management service in firmware version V1.06.01 and earlier. An unauthenticated remote attacker can send crafted requests to TCP port 5058 to execute arbitrary OS commands with root privileges.
CVE-2026-73167 is an OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. It allows a remote authenticated attacker to execute arbitrary OS commands as root by sending crafted request parameters. The vulnerability is identified as CWE-78 and has a high severity score of 8.6. No known exploits are reported in the wild. The affected versions include all firmware versions from 0 up to and including 1.06.01.
CVE-2026-73165 is an OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. It allows a remote authenticated attacker to execute arbitrary OS commands as root by sending crafted request parameters. The vulnerability is classified as CWE-78 and has a high severity with a CVSS 4.0 score of 8.6.
CVE-2026-73164 is an OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. It allows a remote authenticated attacker to execute arbitrary OS commands as root by sending crafted request parameters. The vulnerability is classified as CWE-78 and has a high severity with a CVSS score of 8.6.
CVE-2026-73163 is a high-severity OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS devices. It affects firmware versions up to and including V1.06.01. A remote authenticated attacker can exploit this flaw by sending crafted request parameters to execute arbitrary OS commands with root privileges.
WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system.
This issue has been fixed in firmware version 1.1.0.651412
WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.