CWE-78

High likelihood

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Parent: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

5,945 vulnerabilities with CWE-78
CVE-2026-9404 CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection
CVSS 9.8
CVE-2026-9388 CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection
CVSS 9.8
CVE-2026-9387 CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection
CVSS 9.8
CVE-2026-9386 CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection
CVSS 9.8
CVE-2026-9385 CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection
CVSS 9.8
CVE-2026-9384 CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection
CVSS 9.8
CVE-2026-9367 HIGH
NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection
CVSS 7.3
CVE-2026-9347 MEDIUM
Edimax EW-7438RPn webs formWizSurvey os command injection
CVSS 6.3
CVE-2026-9343 MEDIUM
Edimax EW-7438RPn webs formWpsStart os command injection
CVSS 6.3
CVE-2026-9277 HIGH
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
CVSS 8.1
CVE-2026-45255 HIGH
Remote code execution via installer Wi-Fi access point scans
CVSS 7.5
CVE-2026-44076 MEDIUM
Netatalk 3.1.0-4.4.2 - Authenticated OS Command Injection via Volume Path
CVSS 6.7
CVE-2026-44072 LOW
Netatalk 2.2.1-4.4.2 and >=4.5.0 - OS Command Injection via Improper chdir Error Handling
CVSS 3.0
CVE-2026-44055 HIGH
Netatalk 3.1.4-4.4.2 - Authenticated OS Command Injection via Bitwise OR Logic Error
CVSS 7.5
CVE-2026-20206 MEDIUM
Cisco ThousandEyes BrowserBot Command Injection Vulnerability
CVSS 6.3
CVE-2026-34234 CRITICAL
CtrlPanel: Unauthenticated RCE using installer script
CVSS 10.0
CVE-2026-8603 CRITICAL
Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR
CVSS 9.8
CVE-2026-36828 HIGH
Panabit PAP-XM320 <= v7.7 - Authenticated OS Command Injection via runcmd Parameter
CVSS 8.8
CVE-2026-36827 MEDIUM
Panabit PAP-XM320 <= V7.7 - Authenticated Command Injection via /usr/sbin/pappiw Helper
CVSS 5.4
CVE-2026-37281 CRITICAL
Zenshin < 2.7.0 - OS Command Injection via /stream-to-vlc URL Parameter
CVSS 9.8
CVE-2026-27130 CRITICAL
Dokploy has Command Injection in its Service Operations
CVSS 9.9
CVE-2026-25244 CRITICAL
WebdriverIO has Command Injection in the BrowserStack Service
CVSS 9.8
CVE-2026-8767 MEDIUM
vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection
CVSS 5.0
CVE-2026-45036 HIGH
Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh
CVSS 7.0
CVE-2026-45035 HIGH
Tabby: RCE via `tabby://run` URL Scheme
CVSS 8.8
Details
Vulnerabilities 5,945
Exploit Likelihood High