A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.
CVE-2026-2740 is a high-severity vulnerability in Zohocorp ManageEngine ADSelfService Plus and related products before specified versions. It involves improper neutralization of special elements in commands (CWE-77), leading to authenticated remote code execution on agent machines due to a flaw in a third-party dependency. The vulnerability requires low privileges and no user interaction but has a high attack complexity. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.
CVE-2026-5433 is a critical command injection vulnerability in Honeywell International Inc.'s Control Network Module (CNM) web interface. The flaw involves improper neutralization of special elements (CWE-77), allowing an attacker with high privileges to execute arbitrary commands remotely. Affected CNM versions include 100.1, 101.1, 110.1, and 110.2. Honeywell recommends updating to the most recent version 200.1 to mitigate this issue. The vulnerability has a CVSS 3.1 score of 9.1, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild as of the publication date.
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection.
Red Hat has issued a security advisory for python3 in Red Hat Enterprise Linux 8.4 variants addressing two vulnerabilities: CVE-2026-6100, a use-after-free in decompression modules that could lead to arbitrary code execution or information disclosure, and CVE-2026-4786, a command injection vulnerability in the webbrowser.open() API allowing arbitrary code execution. These vulnerabilities affect python3 packages in Red Hat Enterprise Linux 8.4 Advanced Update Support and Extended Update Support. The advisory rates the security impact as Important and provides updated packages to remediate these issues.
Dell SmartFabric Storage Software versions prior to 1.4.5 contain a command injection vulnerability (CWE-77) that allows a high privileged local attacker to execute arbitrary commands. Exploitation could lead to unauthorized filesystem access. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices.
We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available.
Mitigation FAQs
Should I leverage the temporary mitigation?
Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel.
What impact to service availability/management could be caused by implementing the mitigations?
Implementing these mitigations will not impact service availability or management operations.
Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available?
No. The security update will maintain the mitigation's behavior once the security update is installed.
I am using TPM+PIN, am I at risk of this vulnerability being exploited
No, if you are using TPM+PIN the vulnerability is not exploitable.
A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.
CVE-2026-41953 is a high-severity command injection vulnerability in F5 BIG-IP systems. It allows a highly privileged, authenticated attacker with at least Resource Administrator role to modify configuration objects, potentially leading to privilege escalation. The vulnerability affects multiple BIG-IP versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.
CVE-2026-40698 is a high-severity OS command injection vulnerability in F5 BIG-IP and BIG-IQ systems. It allows a highly privileged, authenticated attacker with at least Resource Administrator role to create SNMP configuration objects via iControl REST or TMOS shell (tmsh), leading to privilege escalation. The vulnerability affects specific versions including 21.0.0, 17.5.0, 17.1.0, and 16.1.
CVE-2026-40061 is a command injection vulnerability in F5 BIG-IP DNS when provisioned, affecting certain versions. It allows an authenticated user with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges. In Appliance mode deployments, exploitation can cross a security boundary. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.
This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.