CVE-2026-39382 is a critical OS command injection vulnerability in dbt-labs dbt-core. It arises from unsafe interpolation of attacker-controlled comment text into a bash if statement within a GitHub Actions workflow. This allows an attacker to inject arbitrary shell commands. The vulnerability affects versions prior to commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. A fix has been implemented in that commit. The CVSS 4.0 score is 9.3, indicating critical severity with network attack vector and no required privileges or user interaction.
CVE-2026-35581 is an OS command injection vulnerability in the NationalSecurityAgency's Emissary product prior to version 8.39.0. The Executrix utility class improperly sanitizes the PLACE_NAME parameter by only replacing spaces with underscores, allowing shell metacharacters to be injected into commands executed via /bin/sh -c. This flaw enables an attacker with high privileges to execute arbitrary commands with high impact on confidentiality, integrity, and availability. The vulnerability is fixed in version 8.39.0. No official patch link or vendor advisory is provided in the data, and no known exploits are reported in the wild.
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
A high-severity remote code execution vulnerability (CVE-2026-35517) exists in Pi-hole FTL versions 6.0 up to but not including 6.6. The vulnerability arises from improper neutralization of special elements in the upstream DNS servers configuration parameter, allowing an authenticated attacker to inject arbitrary dnsmasq configuration directives via newline characters. This injection can lead to command execution on the underlying system. The issue is fixed in version 6.6. No known exploits in the wild have been reported as of the publication date.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.
Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
CVE-2026-5709 is a high-severity OS command injection vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. It arises from unsanitized input in the FileBrowser API, allowing a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance. AWS has released a fix in RES version 2026.03 and provides a mitigation patch for existing environments. This vulnerability requires authenticated access and does not have known exploits in the wild at this time.
CVE-2026-5707 is an OS command injection vulnerability in AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01. It arises from unsanitized input in the handling of virtual desktop session names, allowing a remote authenticated user to execute arbitrary commands as root on the virtual desktop host. AWS has released a fix in version 2026.03 and recommends upgrading or applying the mitigation patch.
Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optional password to accompany the JPEG. This password is then directly passed into an expect command, which is then subsequently passed into a bash -c command, without any form of sanitization or validation. An unauthenticated attacker can achieve root-level RCE inside the worker container with a single HTTP request, enabling full read/write access to all user-uploaded images, analysis results, and plaintext steganography passwords stored on disk. Because the container shares a Docker network with PostgreSQL and Redis (no authentication on either), the attacker can pivot to dump the entire database or manipulate the job queue to poison results for other users. If Docker socket mounting or host volume mounts are present, this could escalate to full host compromise. This would also include defacement of the website itself. This vulnerability is fixed in 3.2.1.
KubeAI versions prior to 0.23.2 contain an OS command injection vulnerability in the ollamaStartupProbeScript() function. This function unsafely constructs shell commands from unsanitized model URL components, which are executed as Kubernetes startup probes. An attacker with permissions to create or update Model custom resources can inject arbitrary shell commands that run inside model server pods. This vulnerability is fixed in version 0.23.2.
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'. This issue has been patched in version 4.5.97.
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "<code>" and passing it to subprocess.run(..., shell=True). The escaping logic only handles \ and ", leaving $() and backtick substitutions unescaped, allowing arbitrary OS command execution before Python is invoked. This issue has been patched in version 1.5.90.
PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. This issue has been patched in version 4.5.69.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
CVE-2026-5485 is an OS command injection vulnerability in the browser-based authentication component of the Amazon Athena ODBC driver on Linux. It affects versions before 2.0.5.1 and allows a local user to execute arbitrary code by supplying specially crafted connection parameters. The vulnerability has a high severity with a CVSS score of 7.8. Users should upgrade to version 2.0.5.1 or later to remediate the issue.
Server names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.
PoC:
```python
from fastmcp import FastMCP
mcp = FastMCP(name="test&calc")
@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
"""Roll `n_dice` 6-sided dice and return the results."""
return [random.randint(1, 6) for _ in range(n_dice)]
```
```
fastmcp install claude-code server.py # or: fastmcp install gemini-cli server.py
```
On Windows, this opens Calculator via the `&calc` in the server name.
Impact:
Arbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).
Patched in #3522 by validating server names to reject shell metacharacters.
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
Endian Firewall version 3.3.25 and earlier contains an OS command injection vulnerability in the DATE parameter of the /cgi-bin/logs_smtp.cgi endpoint. Authenticated users can exploit this flaw due to insufficient validation of the DATE parameter, which is used in constructing a file path passed to a Perl open() call. This improper neutralization of special elements allows arbitrary OS command execution. The vulnerability has a high severity with a CVSS 4.0 base score of 8.7. No patch or official remediation has been provided yet, and no known exploits are reported in the wild.