CWE-78
High likelihoodImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
6,224 vulnerabilities with CWE-78
CVE-2026-8153
CRITICAL
Command injection in Dashboard Server interface
CVSS 9.8
CVE-2026-43943
HIGH
electerm: RCE via malicious SSH server filename in openFileWithEditor
CVSS 7.8
CVE-2026-42271
HIGH
KEV
LiteLLM: Authenticated command execution via MCP stdio test endpoints
CVSS 8.8
CVE-2026-41900
HIGH
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
CVSS 8.8
CVE-2026-8112
MEDIUM
8421bit MiniClaw kernel.ts executeCognitivePulse os command injection
CVSS 6.3
CVE-2026-42215
HIGH
GitPython: Command injection via Git options bypass
CVSS 8.8
CVE-2026-31196
HIGH
ALTICE LABS GR140DG/GR140IG - Command Injection
CVSS 8.8
CVE-2026-31195
HIGH
ALTICE LABS GR140DG/GR140IG - Command Injection
CVSS 8.8
CVE-2026-36356
CRITICAL
MeiG Smart FORGE_SLT711 MDM9607.LE.1.0-00110 - Command Injection
CVSS 9.1
CVE-2026-7823
CRITICAL
Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection
CVSS 9.8
CVE-2026-7785
HIGH
A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection
CVSS 7.3
CVE-2026-41926
CRITICAL
WDR201A WiFi Extender OS Command Injection via firewall.cgi
CVE-2026-41925
CRITICAL
WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)
CVE-2026-41924
CRITICAL
WDR201A WiFi Extender OS Command Injection via makeRequest.cgi
CVE-2026-41923
CRITICAL
WDR201A WiFi Extender OS Command Injection via internet.cgi
CVE-2026-41922
CRITICAL
WDR201A WiFi Extender OS Command Injection via wireless.cgi
CVE-2026-42076
CRITICAL
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
CVSS 9.8
CVE-2026-7730
MEDIUM
privsim mcp-test-runner MCP index.ts child_process.spawn os command injection
CVSS 6.3
CVE-2026-42364
CRITICAL
GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability
CVSS 9.9
CVE-2026-7698
HIGH
Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection
CVSS 7.3
CVE-2026-7653
MEDIUM
r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection
CVSS 6.3
CVE-2026-7642
MEDIUM
pskill9 website-downloader MCP index.ts download_website os command injection
CVSS 6.3
CVE-2026-7609
MEDIUM
TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection
CVSS 6.3
CVE-2026-7608
MEDIUM
TRENDnet TEW-821DAP tools_diagnostic os command injection
CVSS 5.5
CVE-2026-7600
MEDIUM
ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection
CVSS 6.3
Details
Vulnerabilities
6,224
Exploit Likelihood
High