CWE-78: OS Command Injection vulnerabilities

CVE-2026-65612 is an OS command injection vulnerability in nnn version 5.2. The software does not sanitize filenames, allowing an attacker to craft a malicious filename containing shell syntax. When a user previews such a file, the embedded shell command executes the injected payload with the privileges of the nnn process.

CVE-2026-65611 is an OS command injection vulnerability in the nnn file manager version 5.2. The flaw arises because nnn does not sanitize directory names containing shell metacharacters, allowing an attacker to craft a directory name that injects arbitrary shell commands. When a user enters such a directory and uses batch copy or move operations, the injected commands execute with the privileges of the nnn process.

Streambert, a cross-platform Electron desktop app for streaming and downloading video content, has an improper input validation vulnerability in versions prior to 2.6.0. The open-path-at-time IPC handler accepts a file path from the renderer process without validating its type or location. If attempts to launch mpv or VLC are skipped or fail, the handler passes this file path to Electron's shell.openPath, which can cause the operating system to execute arbitrary files with the privileges of the Streambert process. This allows a compromised renderer to escape the sandbox and execute local executables or scripts. The issue is fixed in version 2.6.0.

CVE-2026-55426 is an OS command injection vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins. The issue arises from user-controlled values embedded in command strings passed to shell execution functions, allowing injection of arbitrary commands via pipe characters. Specifically, the restic-check plugin's --repo parameter could be exploited to run commands as root due to sudo authorization. The vulnerability affects versions prior to linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0. Fixes include using argv lists, disabling shell execution, removing pipe splitting, and sanitizing inputs. The vulnerability has a high severity score of 7.8 CVSS 3.1 and is fixed in the stated versions.

CVE-2026-53455 is an OS command injection vulnerability in ha-china's Blueprint Studio, a VS Code-like editor for Home Assistant configuration files. Versions prior to 2.5.2 generate a shell-based Git credential helper by directly embedding user-configured Git usernames and tokens without validation. This allows an attacker who can set Git credentials to inject shell commands via special characters in the username or token. When Git runs the helper, the injected commands execute with Home Assistant's OS privileges, potentially accessing or modifying configuration data. The issue is fixed in version 2.5.2.

CVE-2026-68519 is an OS command injection vulnerability in the open-source monitoring tool Glances. Versions prior to 4.5.6 allow execution of shell commands with operators such as redirection, chaining, or pipes when an alert triggers, due to improper handling of the --disable-config-exec flag in GlancesActions.run(). This issue is resolved in version 4.5.6.

CVE-2026-62982 is a high-severity OS command injection vulnerability in the open-source monitoring tool Glances. Versions from 4.5.2 up to but not including 4.5.6 improperly sanitize nested list and dictionary strings in process command line values, allowing malicious pipe characters to be executed via administrator-configured action templates. This flaw is fixed in version 4.5.6.

CVE-2026-68518 is an OS command injection vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 improperly sanitize Mustache template variables, allowing attackers to reconstruct shell operators that are executed by the secure_popen() function. This flaw is fixed in version 4.5.6.

CVE-2026-75056 is a high-severity vulnerability in JetBrains IntelliJ IDEA prior to version 2026.2.1. It involves a remote code execution (rCE) flaw via the Markdown export tool. The vulnerability is identified as CWE-78, which relates to improper neutralization of special elements used in a command ('Command Injection').

CVE-2026-71567 is a high-severity vulnerability in the openshift-metal3 project, specifically in the fakefish component. It involves improper neutralization of special elements used in OS commands (CWE-78), where shell variables are injected without proper quoting in scripts. This affects parameters such as Image URL and BMC credentials, which are not verified by FakeFish, potentially allowing command injection. The vulnerability affects version 0 of fakefish. No official patch or remediation guidance is currently available.

Dell ObjectScale versions prior to 4.3.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows a low privileged local attacker to execute arbitrary commands. This vulnerability is due to improper neutralization of special elements in OS commands. The issue has been fixed in version 4.3.0.1.

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVE-2026-74997 is a high-severity vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.18 and 1.7.0 up to but not including 1.7.3. The issue exists in the cmd_learn driver of the markasjunk plugin, which allows remote code execution via crafted placeholder replacement values. This vulnerability only impacts Roundcube instances that have the markasjunk plugin enabled with its cmd_learn driver. Fixed versions 1.6.18 and 1.7.3 address this flaw.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.