Chamilo LMS versions prior to 2.0.0-RC.3 contain an OS Command Injection vulnerability in the gradebook.ajax.php endpoint. The vulnerability arises because the course code from the session variable is directly concatenated into a shell_exec() command without proper sanitization. An attacker able to manipulate session data can inject shell metacharacters, leading to arbitrary command execution on the server. This can result in full system compromise, including reading sensitive files, altering the application or database, and disrupting server availability. The issue is fixed in version 2.
CVE-2026-40288 is a critical OS command injection vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions prior to 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents improperly handle untrusted YAML workflow files, allowing arbitrary command and code execution without validation or sandboxing. This occurs because the workflow engine executes shell commands and Python scripts directly from YAML files, exposing the host system to full compromise if an attacker can supply or influence these files. The vulnerability is fixed in versions 4.5.139 and 1.
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LD_PRELOAD-based sandbox. By env command the attacker can clear the environment variables and drop the sandbox.so hook, leading to unrestricted Remote Code Execution (RCE) and network access. MaxKB restricts untrusted Python code execution via the Tool Debug API by injecting sandbox.so through the LD_PRELOAD environment variable. This intercepts sensitive C library functions (like execve, socket, open) to restrict network and file access. However, a patch allowed the /usr/bin/env utility to be executed by the sandboxed user. When an attacker is permitted to create subprocesses, they can execute the env -i python command. The -i flag instructs env to completely clear all environment variables before running the target program. This effectively drops the LD_PRELOAD environment variable. The newly spawned Python process will therefore execute natively without any sandbox hooks, bypassing all network and file system restrictions. This issue has been fixed in version 2.8.0.
CVE-2026-39417 is an OS command injection vulnerability in 1Panel-dev MaxKB versions 2.7.1 and below. It arises from an incomplete fix for a previous vulnerability (CVE-2025-53928) where the MCP node configuration can still be injected via user-supplied JSON in the workflow creation API. This allows an attacker with limited privileges to inject arbitrary commands that execute when the workflow is triggered. The issue is fixed in version 2.8.0. The CVSS score is 4.6, indicating medium severity.
simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.
The golang packages provide the Go programming language compiler.
Security Fix(es):
* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-4157 is a high-severity OS command injection vulnerability in ChargePoint Home Flex devices, specifically in version 5.5.4.13. It arises from improper validation of user-supplied strings in OCPP message handling, allowing network-adjacent attackers to execute arbitrary code as root without authentication. The vulnerability was identified by ZDI as ZDI-CAN-26338. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter — which only passes through Security::remove_XSS() (an HTML-only filter) — is concatenated directly into shell commands such as exec("mv $source $target"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.
Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system.
This issue affects:
Junos OS:
* all versions before 22.4R3-S8,
* from 23.2 before 23.2R2-S5,
* from 23.4 before 23.4R2-S7,
* from 24.2 before 24.2R2-S2,
* from 24.4 before 24.4R2,
* from 25.2 before 25.2R2;
Junos OS Evolved:
* all versions before 22.4R3-S8-EVO,
* from 23.2 before 23.2R2-S5-EVO,
* from 23.4 before 23.4R2-S7-EVO,
* from 24.2 before 24.2R2-S2-EVO,
* from 24.4 before 24.4R2-EVO,
* from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction. This vulnerability is fixed in 1.5.128.
PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.
UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.
parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection via crafted volume path arguments containing shell metacharacters. An attacker can provide a crafted volume path via the -v flag that injects arbitrary commands during volume content enumeration.
parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename with embedded shell metacharacters that execute arbitrary commands on the forensic examiner's machine during USB artifact parsing.
CVE-2026-39862 is an OS command injection vulnerability in Shopify's Tophat mobile application testing harness versions prior to 2.5.1. The vulnerability allows remote code execution via crafted tophat:// or http://localhost:29070 URLs, where the arguments query parameter is unsanitized and passed directly to a bash shell command. This enables an attacker to execute arbitrary commands on a developer's macOS workstation with the user's permissions, without any confirmation dialog for previously trusted build hosts. The issue is fixed in version 2.5.1.
An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow the attacker to modify device configuration, access sensitive information, or further compromise system integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
An OS command injection vulnerability in the OpenVPN module
of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
CVE-2026-27806 is an OS command injection vulnerability in the Fleet open source device management software prior to version 4.81.1. It arises from improper handling of a local user's password in the Orbit agent's FileVault disk encryption key rotation flow. The password is interpolated directly into a Tcl/expect script, allowing a specially crafted password containing the '}' character to inject arbitrary Tcl commands. Because the Orbit agent runs with root privileges, this vulnerability allows local unprivileged users to escalate privileges to root. The issue is fixed in Fleet version 4.81.1.
CVE-2026-5208 is a high-severity OS command injection vulnerability in CoolerControl's coolercontrold versions prior to 4.0.0. Authenticated users with high privileges can inject arbitrary bash commands via alert names, leading to root-level code execution. This vulnerability affects version 3.1.0 and potentially other versions below 4.0.0. There is no official patch or remediation level currently provided by the vendor.