CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Parent: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

326 vulnerabilities with CWE-88
CVE-2026-40938 HIGH
Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
CVSS 7.5
CVE-2026-6437 MEDIUM
AWS EFS CSI Driver Mount Option Injection
CVSS 6.5
CVE-2026-35153 MEDIUM
Dell PowerProtect Data Domain 7.7.1.0-8.7.0.0 - Command Injection
CVSS 6.7
CVE-2026-4145 HIGH
Lenovo Software Fix <7.5.5.19 - Privilege Escalation
CVSS 7.8
CVE-2026-39884 HIGH
MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting
CVSS 8.3
CVE-2026-35033 CRITICAL
Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
CVSS 9.1
CVE-2026-2449 CRITICAL
upKeeper Instant Privilege Access <=1.5.0 - Command Injection
CVE-2026-40113 HIGH
PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
CVSS 8.4
CVE-2026-35585 HIGH
File Browser has a Command Injection via Hook Runner
CVSS 7.2
CVE-2026-34769 HIGH
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
CVSS 7.7
CVE-2026-35538 LOW
Roundcube Webmail < 1.5.14 - CSRF
CVSS 3.1
CVE-2026-0634 HIGH
Code Execution in AssistFeedbackService on TECNO Pova7 Pro 5G
CVSS 7.8
CVE-2026-29954 HIGH
KubePlus 4.1.4 - SSRF
CVSS 7.6
CVE-2026-23924 MEDIUM
Agent 2 Docker plugin arbitrary file read via Docker API injection
CVE-2026-2298 CRITICAL
Salesforce Marketing Cloud Engagement - Command Injection
CVSS 9.4
CVE-2026-4438 MEDIUM
gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
CVSS 5.4
CVE-2026-29608 MEDIUM
OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting
CVSS 6.7
CVE-2026-22168 MEDIUM
OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run
CVSS 6.5
CVE-2026-1717 MEDIUM
Lenovo Vantage/Baiying - Privilege Escalation
CVSS 5.5
CVE-2026-1716 HIGH
Lenovo Vantage/Baiying - Privilege Escalation
CVSS 7.1
CVE-2026-1715 HIGH
Lenovo Vantage/Baiying - Privilege Escalation
CVSS 7.1
CVE-2026-25689 MEDIUM
Fortinet FortiDeceptor - Command Injection
CVSS 6.5
CVE-2026-3682 MEDIUM
welovemedia FFmate <=2.0.15 - Command Injection
CVSS 6.3
CVE-2026-26194 HIGH
Gogs <0.14.2 - Command Injection
CVSS 7.3
CVE-2026-20016 MEDIUM
Cisco FXOS Software - Command Injection
CVSS 6.0
Details
Vulnerabilities 326
Links
MITRE CWE Entry Search this CWE With Exploits