Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection.
This issue affects Pardus Pen: before 4.2.1.
CVE-2026-0304 is a privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM. It allows an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM. The vulnerability is related to argument injection (CWE-88). It affects versions from 20.0.96 up to but not including 32.0.52. A fix is available in version 32.0.52. The CVSS 4.0 base score is 4.8, indicating medium severity.
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.
Command Argument Injection Vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information.
CVE-2026-55673 is an OS command injection vulnerability in powsybl-core prior to version 7.2.2. It arises from insufficient escaping of command arguments and environment variables in UnixLocalCommandExecutor and WindowsLocalCommandExecutor, allowing attacker-controlled input to execute arbitrary shell commands as the JVM user. This affects multiple components including action-simulator, security-analysis, and dynamic-security-analysis, and can be exploited remotely via downstream tools and services that forward untrusted parameters. The issue is fixed in version 7.2.2.
CVE-2026-81529 is a high-severity vulnerability in the MongoDB C# Driver involving improper neutralization of delimiters in connection-URL construction. This flaw allows a low-privileged user to inject or suppress security-relevant connection options by passing untrusted text that is not properly sanitized. The vulnerability affects specific versions of the driver and could lead to unauthorized modification of connection settings.
CVE-2026-62867 is a critical vulnerability in Incus, a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-supplied 'block.create_options' in storage volume configuration allows argument injection in the filesystem creation command line. This flaw enables a project-scoped user to inject arbitrary arguments into a root-executed binary. The issue is patched in version 7.3.0.
CVE-2026-63046 is a high-severity vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw involves improper neutralization of argument delimiters in a command, specifically in the Agent Installer's ModuleManager component, which executes arbitrary shell commands via ExcuteLinux.exeCmd() without filtering or whitelist validation. This allows potential command injection. Users are advised to upgrade to version 2.4.0 or apply specific patches to remediate the issue.
CVE-2026-65770 is a critical vulnerability in Microsoft Azure Managed Instance for Apache Cassandra involving improper neutralization of argument delimiters, also known as argument injection. This flaw allows an unauthorized attacker to execute code remotely over the network. The vulnerability has a CVSS score of 10.0, indicating maximum severity with high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this cloud service vulnerability.
CVE-2026-48711 is a command injection vulnerability in sshfs, a network filesystem client for SSH servers. Versions from 1.4 up to but not including 3.7.6 are affected. The flaw arises when sshfs accepts a bracketed mount source with a ProxyCommand option, improperly handling the host argument and allowing an attacker-controlled ProxyCommand to execute locally before SSH connection or authentication. This can lead to arbitrary command execution with the privileges of the user running sshfs. The issue is fixed in version 3.7.6.
Linuxfabrik monitoring-plugins prior to version 5.1.0 contain an argument injection vulnerability in the sudoers policy that allows the nagios or icinga monitoring accounts to execute /usr/bin/apt-get as root without argument restrictions. This flaw enables an attacker with control over the monitoring account to execute arbitrary commands with root privileges via the APT::Update::Pre-Invoke option, leading to full host compromise. The issue is fixed in version 5.1.0.
uniget CLI versions prior to 0.27.6 contain a command injection vulnerability in the hooks edit command. The vulnerability arises because the UNIGET_EDITOR or EDITOR environment variables are split on spaces and each segment is passed as an argument to the editor executable without shell evaluation. This can allow an attacker who controls the editor environment and triggers hook editing to supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process. The issue is fixed in version 0.27.6.
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
CVE-2026-53783 is a high-severity vulnerability in rsync versions up to 3.4.4. It involves a time-of-check to time-of-use (TOCTOU) race condition in the rrsync restricted shell wrapper, allowing authenticated clients to bypass directory restrictions by substituting symlinks after validation. Attackers can exploit certain unrestricted flags to read or write files outside the allowed directory subtree.
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document.
For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection.
Any caller that renders untrusted HTML lets the document choose the renderer's options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.
Specifically crafted inputs may lead to git argument injection in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.