CWE-78: OS Command Injection vulnerabilities

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

CVE-2026-85012 is a high-severity OS command injection vulnerability in the blueprint resynthesis framework of Amazon Web Services codecatalyst-blueprints versions before 0.3.156. It allows a user with commit permissions to execute arbitrary commands via shell metacharacters in the owner field of a local merge strategy entry in a crafted .ownership-file. Version 0.3.156 and later remove shell interpretation of this field and enforce an allowlist, eliminating the injection risk. The AWS CodeCatalyst service itself applies server-side validation and isolated execution environments, so no action is required for users of the managed service.

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

Dell SmartFabric OS10 Software versions prior to 10.5.6.14 contain an OS command injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability is fixed in version 10.5.6.14.

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

SEPPmail Secure Email Gateway versions before 15.0.7 contain a command injection vulnerability (CWE-78) that allows authenticated administrators to execute OS commands with elevated privileges. This vulnerability has a high severity score of 8.6 and affects all versions from initial up to but not including 15.0.7.

SEPPmail Secure Email Gateway versions before 15.0.6 contain a deserialization vulnerability in a privileged REST import workflow. This flaw allows an attacker with a privileged API token to execute arbitrary commands with "nobody" privileges due to inadequate validation of attacker-controlled data.

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified.

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain. This issue affects yast2-samba-client through 5.0.4.

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping. Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry. This issue affects yast2-users through 5.0.8.

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

CVE-2026-59111 is a critical OS command injection vulnerability in the Ministry of the Interior (MVČR) eObčanka-Identifikace application on MacOS. Prior to version 3.6.0, the application improperly neutralizes special elements in incoming URL parameters, which are passed unsanitized to an AppleScript wrapper. This allows an attacker to register a custom URL scheme and execute parameterized commands. The vulnerability has a high CVSS score of 9.3, indicating severe confidentiality and integrity impact without availability impact. No patch or official remediation guidance is currently available.