CWE-78: OS Command Injection vulnerabilities

CVE-2026-90868 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker with limited privileges to execute arbitrary commands without user interaction under certain configurations. The vulnerability has a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 have been released to address this issue.

CVE-2026-90865 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a CVSS 3.1 score of 9.0, indicating high impact on confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 have been released to address this issue.

CVE-2026-104308 is an OS command injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.3. It allows a remote authenticated attacker to cause a denial of service by improper neutralization of special elements used in OS commands. The vulnerability does not impact confidentiality or integrity but affects availability.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an OS command injection vulnerability (CWE-78) that allows a remote authenticated attacker to execute arbitrary code. This occurs due to improper neutralization of special elements in OS commands. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

CVE-2026-33924 is a high-severity OS command injection vulnerability in Nozomi Networks Guardian affecting versions prior to 26.4.0. It arises from insufficient validation of update bundle contents in the update installation functionality. An attacker with administrative privileges can remotely supply a crafted update bundle that executes arbitrary commands with root privileges, potentially allowing unauthorized access to sensitive data, configuration changes, or appliance shutdown.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)"` are affected the same way. Version 0.40.6 passes any version pattern containing `#` or a newline through the `.nvmrc` content parser first, so no `#` reaches the sed program.

openEQUELLA versions prior to 2026.1 contain an OS command injection vulnerability in the system.execute() function of the scripting engine. This function executes supplied operating system commands without validation or an allow-list, allowing users with script creation or editing privileges to run arbitrary commands with the openEQUELLA service account's privileges. The issue is fixed in version 2026.1.

CVE-2026-61567 is a critical OS command injection vulnerability in WWBN AVideo-Encoder versions prior to 8.1.0. The live-streaming endpoint improperly trusts attacker-controlled JSON data without proper validation or escaping, allowing unauthenticated remote attackers to execute arbitrary OS commands as the web-server user. This can lead to credential disclosure, platform compromise, file modification, persistence, and denial of service. The issue is fixed in version 8.1.0.

CVE-2026-78674 is an OS command injection vulnerability in WSO2 Enterprise Integrator (BPS profile) affecting versions up to 6.6.0 and 3.6.0. Authenticated users can exploit insufficient input validation in the BPMN System REST APIs to execute arbitrary commands on the server with the runtime account's privileges. The impact depends on the permissions of this account. The vulnerability has a high severity CVSS score of 8.8.

CVE-2026-118615 is a high-severity OS command injection vulnerability in the torch_safe_load function of Ultralytics version 8.4.65. It allows remote attackers to execute arbitrary code by supplying malicious input that is improperly validated before being used in a system call. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file.

CVE-2026-118607 is an OS command injection vulnerability in the diagapp component of Alpine iLX-F511 devices, specifically version 7.0.000. This flaw allows an attacker with physical access to execute arbitrary code as root without authentication. The vulnerability arises from improper validation of user-supplied input used in system calls.

CVE-2026-106079 is an OS Command Injection vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's AccessManager component. It allows an attacker with configuration write privileges to execute arbitrary commands as root via the YANG configuration interface. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

FOGProject versions prior to 1.5.10.2253 contain an OS command injection vulnerability in the API endpoint for editing storage nodes. An authenticated user with specific API tokens can modify storage node fields that are later used unsafely in a root-level command, allowing command execution as root. This vulnerability is fixed in version 1.5.10.2253.

A critical OS Command Injection vulnerability exists in Topluyo Desktop for Linux versions prior to 2026.9.2410. The flaw arises from unsafe processing of user-controlled URLs in the openExternalLinks() function within utils.js. Exploitation allows an attacker to execute arbitrary OS commands with the privileges of the user running the application. The issue is patched in version 2026.9.2410.

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.