CVE-2026-113776 is an OS command injection vulnerability in pypa virtualenv versions from 20.26.6 up to but not including 21.14.2. The issue arises from the way ViaTemplateActivator.instantiate_template() replaces placeholders in activation templates, allowing crafted values in environment paths or prompts to break out of quoting and execute arbitrary commands when activating the environment. This affects activation scripts for bash, fish, xonsh, and activate_this.py. The vulnerability is fixed in version 21.14.2.
A command injection vulnerability exists in pypa virtualenv versions prior to 21.14.2. The issue arises because FishActivator inherits a quoting method that uses POSIX shlex.quote(), which is incompatible with the fish shell's interpretation of backslashes and single quotes. An attacker can craft environment variables such as the path, --prompt, or VIRTUALENV_PROMPT containing a backslash before a quote to break out of the fish literal and execute arbitrary commands when the user sources activate.fish. This vulnerability is fixed in version 21.14.2.
CVE-2026-35499 is a critical OS command injection vulnerability in the boa formWsc peerRptPin functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device without user interaction.
CVE-2026-40627 is a critical OS command injection vulnerability in the boa formWsc targetAPSsid functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device, potentially compromising confidentiality, integrity, and availability.
CVE-2026-33568 is a critical OS command injection vulnerability in the boa formMapDelDevice macstr functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device without user interaction.
CVE-2026-9814 is a critical OS command injection vulnerability in the boa formWizard newPass functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device without user interaction.
CVE-2026-10131 is a critical OS command injection vulnerability in the boa formPasswordSetup functionality of the TOTOLINK X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device without user interaction.
An OS command injection vulnerability (CWE-78) exists in the batchupg functionality of the TOTOLINK X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device. This vulnerability has a high severity with a CVSS score of 9.1, indicating critical impact on confidentiality, integrity, and availability.
CVE-2026-10138 is a critical OS command injection vulnerability in the boa formUpload() functionality of the TOTOLINK X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device without user interaction.
CVE-2026-113725 is an OS command injection vulnerability in the bash activate script of pypa virtualenv versions prior to 21.14.7. The vulnerability arises because the environment name used in the PS1 prompt is not properly escaped for both passes bash makes over PS1, allowing specially crafted environment names containing backslash and command substitution sequences to execute arbitrary commands in the user's shell. This affects users who source the activate script of an environment with an attacker-controlled name. The issue is fixed in version 21.14.7.
CVE-2026-113723 is an OS command injection vulnerability in the pypa virtualenv tool prior to version 21.14.9. The flaw allows attacker-controlled prompt text to be interpreted as executable syntax in the bash activation prompt. Exploitation requires an attacker to influence the prompt text passed to virtualenv and a user to activate the environment and view the prompt. This vulnerability is fixed in version 21.14.9.
CVE-2026-113722 is an OS command injection vulnerability in pypa virtualenv versions prior to 21.14.9. The issue arises from incomplete quoting of interpreter paths containing spaces or long shebangs when generating POSIX console scripts, allowing command substitutions to be executed. This can lead to arbitrary command execution with the user's privileges when running a generated launcher. Existing launchers remain vulnerable even after upgrading virtualenv and must be regenerated. The vulnerability is fixed in version 21.14.9.
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
### Summary
`PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with `-dSAFER` enabled).
### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
#### Type
CWE-88 (Argument Injection) (→ CWE-78 (OS Command Injection) optionally, with attacker controlled text file)
#### Vulnerable Codes
```python
infile_temp = None
if hasattr(fp, "name") and os.path.exists(fp.name):
infile = fp.name # user-controlled path used as-is, without validation
else:
in_fd, infile_temp = tempfile.mkstemp()
os.close(in_fd)
infile = infile_temp
# ... (copy fp into a temporary file)
# Build Ghostscript command
command = [
gs_binary,
"-q",
f"-g{width:d}x{height:d}",
f"-r{res_x:f}x{res_y:f}",
"-dBATCH",
"-dNOPAUSE",
"-dSAFER", # default sandbox — does NOT stop this injection
f"-sDEVICE={device}",
f"-sOutputFile={outfile}",
"-c",
f"{-bbox[0]} {-bbox[1]} translate",
"-f",
infile, # injected here: inserted into argv with no check for
# option prefixes (-, --) or Ghostscript's @-file token
# => argument injection (CWE-88)
"-c",
"showpage",
]
# ...
subprocess.check_call(command, startupinfo=startupinfo) # spawns Ghostscript
```
#### Root cause.
When rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f <infile> position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.
#### Affected
- Pillow: tested on 12.3.0 (latest); vulnerable code is long-standing and appears to affect all current versions (main included).
- Component: `src/PIL/EpsImagePlugin.py`, `Ghostscript()` — `infile = fp.name`, and the command list entry `"-f", infile`.
#### Suggested fix
Normalize the filename to an absolute path before it is passed to Ghostscript, so it can never be parsed as an option (`-`/`--`) or as an argument-file token (`@`):
```python
if hasattr(fp, "name") and os.path.exists(fp.name):
infile = os.path.abspath(fp.name) # was: infile = fp.name
```
`os.path.abspath()` guarantees the path starts with a path separator (or a drive letter on Windows), so a leading `-` or `@` can no longer reach Ghostscript's argument parser. The `else` branch already builds a safe `tempfile.mkstemp()` path and needs no change.
### PoC
dockerfile, Default run shows the argument-injection demo (poc.py); for the RCE PoC run python3 poc-rce.py.
```
FROM ubuntu:24.04
RUN apt update
RUN apt install -y --no-install-recommends python3 python3-venv ghostscript ca-certificates
RUN rm -rf /var/lib/apt/lists/*
RUN python3 -m venv /venv && /venv/bin/pip install --upgrade pip Pillow==12.3.0
ENV PATH=/venv/bin:$PATH
WORKDIR /poc
COPY poc.py .
COPY poc-rce.py .
COPY arg .
CMD ["python3", "poc.py"]
```
poc.py
```
import os
from PIL import Image
############################################################################################
# Attacker controlled file
############################################################################################
EPS = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\nshowpage\n"
name = "-h"
with open(name, "wb") as f:
f.write(EPS)
############################################################################################
print(f"[*] Pillow opens a file whose name is {name!r}")
im = Image.open(name)
print(f"[*] call `load()`; this paths calls `gs` command with '-f {name}'")
try:
im.load()
except Exception as e:
print(f"[*] load() raised: {type(e).__name__}: {e}")
print("CWE-88: argument injection; Pillow code doesn't validate argument name")
print(" This poc.py shows the vulnerability clearly.")
print("
PingTools Network Utilities version 4.64 contains a high-severity OS command injection vulnerability in the Host field of its Watcher ICMP service. An attacker with local access who can create or modify a Watcher service can inject arbitrary shell commands executed with the application's UID and Android permissions. This occurs because the Host input is appended directly to a ping command executed via sh -c without proper sanitization.
CVE-2026-76740 is a high-severity OS command injection vulnerability affecting Hewlett Packard Enterprise (HPE) Compute Scale-up Server 3200 and 3250 platforms, as well as Superdome Flex and Superdome Flex 280 servers. This flaw allows remote attackers with high privileges to execute arbitrary commands on the Remote Management Controller (RMC). The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2. Multiple versions of the affected platforms prior to specific fixed releases are vulnerable.
CVE-2026-108983 is a critical OS command injection vulnerability in GeoVision Inc.'s GV-ASManager product, specifically affecting version 6.3.0. The flaw exists in the Web Server default connection ports managed by the GeoWebServer.exe process. This vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands remotely, potentially leading to full system compromise.
CVE-2024-4457 is a critical OS command injection vulnerability in WSO2 Enterprise Integrator's Management Console. It arises from improper validation of input related to JDBC user store configuration, allowing attackers to execute arbitrary code on the server with WSO2 product privileges. This can lead to full system compromise. The vulnerability affects multiple versions prior to specific fixed releases. A high-severity CVSS score of 9.1 reflects the potential impact. Fixed versions are available, and no known exploits are reported in the wild.
Tektronix 3 Series MDO devices before version 1.21.1 contain an OS command injection vulnerability in the FILESystem:MOUNT:DRIve SCPI command handler. This flaw allows remote attackers with limited privileges to execute arbitrary operating system commands with elevated privileges due to insufficient neutralization of user input.
An OS Command Injection vulnerability (CWE-78) exists in Apache Kylin versions 4.0.4 through 5.0.4. This vulnerability arises from improper neutralization of special elements used in OS commands. The impact is primarily on Kylin services exposed directly to the public network, which is uncommon; most in-house deployments are not affected. The issue is fixed in Apache Kylin version 5.0.5.