CWE-77: Command Injection vulnerabilities

Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.

CVE-2026-40135 is an OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform. It allows an authenticated attacker with administrative privileges to execute crafted shell commands on the server while bypassing logging mechanisms. This can lead to unauthorized command execution impacting the integrity and availability of the application. There is no impact on confidentiality. The vulnerability affects multiple SAP_BASIS versions from 700 through 816. No patch or official remediation guidance is currently provided by the vendor. Exploits in the wild are not known at this time.

CVE-2026-34259 is an OS command injection vulnerability in SAP Forecasting & Replenishment affecting versions SCM 702, 712, 713, and 714. An authenticated attacker with administrative privileges can exploit a non-remote-enabled function to execute arbitrary operating system commands. This could lead to full compromise of confidentiality, integrity, and availability by allowing reading or modification of system data or shutting down the system. The vulnerability has a high severity score of 8.2. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.

PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution. This issue has been patched in version 4.6.9.

CVE-2026-42271 is a command injection vulnerability in BerriAI's LiteLLM proxy server versions 1.74.2 up to but not including 1.83.7. Two endpoints allowed authenticated users, including those with low-privilege API keys, to execute arbitrary commands on the proxy host by submitting crafted server configurations. This flaw arises from insufficient role checks and improper neutralization of command execution parameters. The vulnerability has been patched in version 1.83.7.

A command injection vulnerability (CWE-77) exists in electerm versions prior to 3.3.8. The vulnerability occurs in the runMac() function within install.js, where unvalidated attacker-controlled input is passed to an exec("open ...") command. This flaw allows remote attackers to execute arbitrary commands. The issue has been fixed in version 3.3.8.

A critical command injection vulnerability (CWE-77) exists in electerm versions prior to 3.3.8. The vulnerability occurs in the runLinux() function within the npm/install.js file, where attacker-controlled remote version strings are appended directly into an exec("rm -rf ...") command without proper validation. This flaw allows remote attackers to execute arbitrary commands on the affected system. The issue has been fixed in electerm version 3.3.8.

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.

CVE-2026-40068 is a high-severity vulnerability in anthropics Claude Code versions 2.1.63 through 2.1.83. The issue arises from improper input validation of the git worktree commondir file used in folder trust determination logic. An attacker can craft a malicious repository with a commondir file that points to a path the victim has previously trusted, causing Claude Code to bypass its trust confirmation dialog and execute hooks defined in . claude/settings.json without user consent. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a trusted path on the victim's system.

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.

CVE-2026-7039 is a high-severity command injection vulnerability in tufantunc ssh-mcp versions up to 1.5.0. The flaw exists in the shell.write function of src/index.ts, where manipulation of the Description argument allows local attackers to execute arbitrary commands. Exploit code has been publicly disclosed, but the vendor has not yet responded or issued a fix. The attack requires local access and does not involve user interaction. No official patch or remediation guidance is currently available.

CVE-2026-7037 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. It affects the setVpnPassCfg function within the /cgi-bin/cstecgi.cgi CGI handler. An attacker can remotely manipulate the pptpPassThru argument to execute arbitrary operating system commands. The vulnerability has a high CVSS score of 9.3, indicating severe impact if exploited. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.