By weakness (CWE)

CWE-77: related vulnerabilities

CVEs classified under CWE-77. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

66 published vulnerabilities

• CVE-2024-24909HIGH 8.8

  Dell OpenManage Integration with Microsoft Windows Admin Center contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary code and escalate privileges on affected systems. The vulnerability exists in the gateway plugin component and requires valid credentials to exploit, but once authenticated, an attacker can run code with elevated privileges.

• CVE-2026-11556HIGH 8.8

  Tenda F451 wireless routers running firmware versions 1.0.0.7 or 1.0.0.9 contain a command injection vulnerability in their web management interface. An authenticated attacker can craft malicious input to the MAC address field in the WriteFacMac function, allowing them to execute arbitrary operating system commands on the device. The vulnerability requires login credentials but poses a serious risk because successful exploitation grants full control over the router, potentially compromising all network traffic and devices connected to it.

• CVE-2026-11572HIGH 8.8

  Degit, a popular tool for cloning Git repositories, contains a command injection vulnerability that allows attackers to run arbitrary system commands on machines using vulnerable versions. The flaw exists because the application doesn't properly validate repository names before passing them to shell commands. An attacker only needs to trick a user into cloning from a malicious repository URL to gain code execution with the privileges of the process running degit.

• CVE-2026-12186HIGH 8.8

  GL.iNet's GL-MT3000 router contains a command injection vulnerability in its Tor proxy configuration feature. An authenticated attacker can manipulate the replace_country function to execute arbitrary system commands remotely. The vendor has released version 4.7 as a fix. This is a serious issue affecting routers running versions up to 4.4.5, though it requires valid login credentials to exploit.

• CVE-2026-12187HIGH 8.8

  GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5 contain a command injection vulnerability in the online firmware upgrade mechanism. An authenticated attacker can exploit this flaw to execute arbitrary commands on the device with full system privileges. The vulnerability has been publicly disclosed and proof-of-concept code is available, increasing the risk of active exploitation. GL.iNet has released a patch in version 4.7 that resolves the issue.

• CVE-2026-13545HIGH 8.8

  D-Link DCS-935L network cameras running firmware version 1.10.01 contain a critical flaw in their web configuration interface. An authenticated attacker can inject arbitrary operating system commands through the UID parameter in the setconf.cgi handler, gaining the ability to execute code with the privileges of the camera process. Because the vulnerability requires authentication but offers full system compromise once inside, it represents a high-severity risk for organizations relying on these devices for surveillance infrastructure.

• CVE-2026-42850HIGH 8.8

  Kitty, a GPU-accelerated terminal emulator used across multiple platforms, contains a command injection vulnerability in versions before 0.47.0. An attacker can craft a malicious escape sequence that causes Kitty to generate an unescaped error message. When this error is echoed back to the shell, it executes as a command, allowing arbitrary code execution. The attack requires the victim to be connected to the attacker via netcat or similar network tool, or to initiate a connection to the attacker's system. This is a serious but not immediately widespread threat—it depends on a specific usage pattern and user interaction.

• CVE-2026-53822HIGH 8.8

  OpenClaw versions before 2026.5.18 contain a critical flaw that allows authenticated users to inject arbitrary shell commands by exploiting a timing gap between security approval and execution. An attacker with login credentials can craft malicious arguments that pass an initial security check, then modify them before the command runs—bypassing the allowlist protections meant to prevent unauthorized operations.

• CVE-2024-52011HIGH 8.3

  CVE-2024-52011 is a command injection vulnerability in the launch-editor library, a Node.js utility that opens files in text editors with specified line numbers. Before version 2.9.0, the library failed to properly sanitize filename input on Windows systems, allowing an attacker to inject and execute arbitrary commands by crafting a malicious filename. An attacker would need to trick a user into opening a specially crafted file—typically through a development workflow, build process, or IDE integration—to trigger code execution with the privileges of the affected user.

• CVE-2025-56814HIGH 7.8

  OpenCPN, a navigation software widely used in maritime and recreational boating contexts, contains a vulnerability in how it executes system commands. When the software calls the wxExecute() function, it does not properly sanitize user-supplied input, allowing an attacker with local system access to inject shell commands and run arbitrary code with the privileges of the user running OpenCPN. This is a local privilege escalation risk that requires an attacker to first have access to the affected system.

• CVE-2026-46529HIGH 7.8

  Atril, the default document viewer for MATE desktop environments on Linux, contains a critical vulnerability that allows attackers to execute arbitrary code with a single click. When a user opens a malicious PDF file and clicks on a specially crafted link, the application can be tricked into running attacker-supplied commands. The attack is particularly dangerous because the malicious PDF can be disguised as a legitimate shared library file, making it appear harmless. Affected versions are those prior to 1.26.3 and 1.28.4. The vulnerability stems from improper handling of PDF link destinations without adequate shell-escaping, allowing an attacker to inject executable code through command-line parameters.

• CVE-2026-45497HIGH 7.7

  Microsoft Copilot contains a command injection vulnerability that allows an authenticated attacker to execute arbitrary code through a network connection. The vulnerability arises from improper handling of special characters in command inputs, enabling an attacker with valid credentials to bypass intended restrictions and run code on affected systems. This is not a pre-authentication flaw, meaning the attacker must already have authorized access to Copilot.

• CVE-2026-48116HIGH 7.5

  AnythingLLM versions before 1.13.0 contain a command injection vulnerability in their filesystem search capability. When an authenticated user chats with the filesystem agent, an attacker can craft malicious search patterns that trick the underlying ripgrep tool into executing arbitrary commands on the server. The vulnerability exists because the application doesn't properly isolate user input before passing it to ripgrep, allowing an attacker to inject command-line flags that transform ripgrep into a command executor. Combined with AnythingLLM's file-writing capability, this creates a complete remote code execution path within the container.

• CVE-2026-10214HIGH 7.3

  A command injection vulnerability exists in the Bash Tool component of chatgpt-on-wechat versions up to 2.0.8. An attacker can remotely exploit a flaw in the _get_safety_warning function to execute arbitrary operating system commands without authentication. This issue is being actively exploited in the wild. Organizations using affected versions should prioritize upgrading to 2.0.9 immediately.

• CVE-2026-10219HIGH 7.3

  nextlevelbuilder GoClaw versions up to 3.11.3 contain a command injection vulnerability in the write_file tool. An unauthenticated attacker can manipulate the WriteFile function to inject arbitrary operating system commands, which are then executed on the affected system. The vulnerability is remotely exploitable and does not require user interaction or special privileges.

• CVE-2026-10273HIGH 7.3

  php-censor versions up to 2.1.6 contain a remote code execution vulnerability in the webhook processing logic. An attacker can manipulate the commitId parameter sent to the Webhook Endpoint to inject and execute arbitrary operating system commands on the affected server. No authentication is required, and the exploit technique has been publicly disclosed, increasing the likelihood of active exploitation.

• CVE-2026-11450HIGH 7.3

  A command injection vulnerability exists in GL.iNet GL-MT3000 routers running firmware version 4.4.5 and earlier. An attacker can remotely exploit this flaw by manipulating the device name parameter in the HTTP RPC interface, allowing them to execute arbitrary commands on the affected device without authentication. The issue stems from insufficient input validation in the path normalization handler. GL.iNet has addressed this in firmware version 4.7 and later by implementing method-level validation that prevents the vulnerable eject_disk function from being called through the default RPC endpoint.

• CVE-2026-11451HIGH 7.3

  GL.iNet's GL-MT3000 router firmware version 4.4.5 contains a command injection vulnerability in its FTP configuration handler. An attacker can remotely manipulate the media_dir parameter to inject and execute arbitrary shell commands without authentication. The vulnerability has been patched in firmware version 4.8.1, where the vendor implemented input escaping to neutralize quote-based command injection payloads.

• CVE-2026-11452HIGH 7.3

  A command injection vulnerability exists in GL.iNet's GL-MT3000 router firmware versions up to 4.4.5. An attacker can remotely send a specially crafted password parameter to the SET_USER_PWD handler in the /cgi-bin/glc component, allowing arbitrary command execution on the device without authentication. The vulnerability stems from insufficient input validation when processing password input. GL.iNet has addressed this issue in firmware version 4.8.1 by properly escaping shell metacharacters and containing the password parameter within a safe execution context.

• CVE-2026-14802HIGH 7.3

  A command injection vulnerability exists in create-react-app's browser launching mechanism on macOS. An attacker can manipulate input to the startBrowserProcess function in openBrowser.js, causing arbitrary operating system commands to execute with the privileges of the developer running the build tool. This affects create-react-app versions up to 5.0.1. The vulnerability is remotely exploitable and does not require user authentication or interaction, making it a serious risk for development environments.

• CVE-2026-10870HIGH 7.2

  Shibby Tomato version 1.28.0000 contains a command injection vulnerability in its web-based configuration interface that allows authenticated administrators to execute arbitrary operating system commands on the router. An attacker with administrative access can manipulate the DHCP client startup function to inject malicious commands, potentially compromising the entire device and any network it serves. Exploit code has been published publicly, increasing the risk of opportunistic attacks.

• CVE-2026-10871HIGH 7.2

  Shibby Tomato 1.28.0000 contains a remote command injection vulnerability in its Web UI. An authenticated administrator can craft a malicious request targeting the IPv6 6rd tunnel configuration function, injecting arbitrary operating system commands that execute with the privileges of the affected service. The vulnerability has been publicly disclosed, increasing the likelihood of active exploitation attempts.

• CVE-2026-10872HIGH 7.2

  Shibby Tomato 1.28.0000 contains a vulnerability in the Web UI component that allows authenticated users with high-level privileges to inject operating system commands through the VPN server startup function. An attacker with administrative access could manipulate input parameters to execute arbitrary commands on the device, potentially compromising the entire router system. Public exploit information exists for this vulnerability.

• CVE-2026-10873HIGH 7.2

  Shibby Tomato 1.28.0000 contains a command injection vulnerability in its web interface that allows authenticated administrators to execute arbitrary operating system commands. The vulnerability exists in the rstats_path function within the /bin/rstats component. Because exploit code has been publicly disclosed, the risk of active exploitation is elevated. Note that this project has been superseded by FreshTomato, and users should verify their upgrade path accordingly.

• CVE-2026-12197HIGH 7.2

  A command injection vulnerability exists in Ruijie EG105G-P version 2.340, specifically in the network diagnostic endpoint accessible via the web interface. An authenticated attacker can manipulate the target parameter of the nslookup function to inject and execute arbitrary system commands on the affected device. The vulnerability is remotely exploitable and public exploit code has been released. The vendor has not responded to early disclosure efforts.

• CVE-2026-49196HIGH 7.2

  CVE-2026-49196 is a command injection vulnerability in Acer Predator Connect W6X Wi-Fi devices. The device's built-in feature for blocking Wi-Fi connections fails to properly validate MAC addresses before processing them, creating an opening for attackers to inject and execute arbitrary shell commands. An attacker with administrative access could leverage this to compromise the device and potentially the network it protects.

• CVE-2026-59721HIGH 7.2

  Hoppscotch, an open-source API development platform, contains a critical configuration vulnerability that allows administrators with legitimate access to inadvertently or maliciously enable arbitrary command execution on the backend server. By crafting a specially formatted SMTP URL in the infrastructure settings, an attacker with admin privileges can inject sendmail transport options that execute system commands with root privileges when the service restarts and attempts to send mail. This is a post-authentication attack requiring admin access, but the impact—root code execution on the backend—is severe.

• CVE-2026-9834HIGH 7.2

  A critical flaw exists in the WP Database Backup plugin for WordPress (versions up to 7.11) that allows administrators to inadvertently—or an attacker with admin access to intentionally—inject operating system commands during backup operations. The vulnerability stems from the plugin failing to properly escape user input in one specific backup parameter (the database table exclusion list), while escaping all other parameters correctly. This inconsistency creates an opening for shell command injection. When a backup is triggered, any malicious commands embedded in that parameter will execute with the privileges of the web server.

• CVE-2026-38142MEDIUM 6.5

  Tenda AC18 routers running version 15.03.05.05 contain a vulnerability that allows unauthenticated attackers to execute arbitrary commands on the device. The flaw exists in a web interface endpoint used for internet configuration settings and can be exploited by sending a specially crafted request without requiring any authentication. An attacker on the network—or potentially from the internet if the router's web interface is exposed—could inject malicious commands through a parameter meant to hold MAC addresses, gaining the ability to run code with router-level privileges.

• CVE-2026-42824MEDIUM 6.5

  Microsoft Copilot contains a command injection vulnerability that allows an attacker to craft malicious input and execute unintended commands through the application. An attacker can exploit this flaw to extract sensitive information from a user's system or data accessible through Copilot, but only if the user interacts with the malicious input. The vulnerability does not allow the attacker to modify data or disrupt service availability.

• CVE-2026-42895MEDIUM 6.5

  A command injection vulnerability in Microsoft Copilot allows attackers to manipulate the system's behavior through specially crafted input delivered over the network. The attacker does not need valid credentials or special access, but does require user interaction to trigger the exploit. The vulnerability enables tampering with data or system operations, though it does not expose sensitive information or cause service disruption.

• CVE-2026-57453MEDIUM 6.5

  Vim's bundled zip plugin has a command injection vulnerability when it falls back to PowerShell to work with zip archives on Windows systems. When you open or extract a crafted zip file with a specially designed entry name, the plugin constructs a PowerShell command that improperly quotes the filename. An attacker can exploit this quoting flaw to inject arbitrary PowerShell commands that execute with your user privileges. The vulnerability affects Vim versions 9.1.1784 through 9.2.0677 and is resolved in 9.2.0678.

• CVE-2026-10060MEDIUM 6.3

  TRENDnet's TEW-432BRP wireless router (firmware version 3.10B20) contains a command injection vulnerability in its route configuration interface. An authenticated attacker can manipulate IP, mask, or gateway parameters to inject arbitrary commands on the device. The vulnerability requires valid credentials but poses a direct threat to affected networks. Critically, this product reached end-of-life in 2009—over 15 years ago—and the vendor has stated it cannot replicate or fix vulnerabilities in legacy hardware.

• CVE-2026-10061MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router (firmware version 3.10B20), discovered in the WPS configuration function. An authenticated attacker can manipulate the peerPin parameter to execute arbitrary commands on the device. The vulnerability is network-accessible and requires valid login credentials. Notably, this router reached end-of-life in 2009—over 15 years ago—and TRENDnet has stated they cannot replicate or provide fixes for vulnerabilities in this legacy hardware. While exploit code is public, the practical risk is limited to organizations still operating this obsolete equipment in production environments.

• CVE-2026-10127MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC wireless routers running firmware version 1.23. An authenticated attacker can send a specially crafted web request to the device's configuration interface that tricks it into executing arbitrary system commands. The vulnerability stems from improper validation of the 'rootAPmac' parameter in the device's wireless driver setup function. Because proof-of-concept code has been publicly released, there is a meaningful risk that attackers will attempt to exploit this flaw in active environments.

• CVE-2026-10166MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC version 1.23 that allows an authenticated attacker to execute arbitrary commands on the device. The flaw is in the web interface's wireless settings handler, where the rootAPmac parameter is not properly sanitized before being used in system commands. An attacker with valid login credentials can manipulate this parameter to inject malicious commands, potentially compromising router configuration, data, or availability. Public exploit details are available, increasing real-world risk.

• CVE-2026-10180MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP router (firmware version 3.10B20) that allows authenticated users to execute arbitrary system commands through the formSysCmd web interface parameter. The vulnerability is in the /goform/formSysCmd endpoint and can be exploited remotely by anyone with network access and valid credentials. TRENDnet has not patched this issue because the router reached end-of-life in 2009 and is no longer supported.

• CVE-2026-10182MEDIUM 6.3

  A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. An authenticated attacker can exploit the WLAN setup function by manipulating the 'enrollee' parameter to execute arbitrary commands on the device. The vulnerability has been publicly disclosed. However, this router reached end-of-life in 2009—over 15 years ago—and the vendor has stated they cannot replicate or fix vulnerabilities in products no longer supported. Organizations still operating this hardware face unpatched exposure.

• CVE-2026-10279MEDIUM 6.3

  A remote command injection vulnerability exists in wezterm-mcp version 0.1.0, a WezTerm terminal multiplexer control plane component. An authenticated attacker can manipulate the pane_id parameter in requests to the switch_pane/write_to_specific_pane function to inject arbitrary operating system commands. The vulnerability requires valid credentials to exploit but poses a meaningful risk in environments where WezTerm MCP is exposed to untrusted users or networked clients.

• CVE-2026-10550MEDIUM 6.3

  A command injection vulnerability exists in elunez eladmin versions up to 2.7 within the Application Deployment Module. An authenticated user can manipulate the uploadPath argument to inject arbitrary commands, leading to remote code execution on the affected system. The vulnerability requires valid credentials to exploit but does not need user interaction once authenticated. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-10878MEDIUM 6.3

  A command injection vulnerability has been discovered in D-Link DWR-M920 routers running firmware versions 1.1.50 and 1.1.70. An authenticated attacker can manipulate a parameter in the SMS management interface to inject and execute arbitrary system commands. This requires an existing login to the device but does not require user interaction once authenticated. Public exploits are now available, increasing the practical risk.

• CVE-2026-11339MEDIUM 6.3

  A command injection vulnerability exists in D-Link DWR-M920 routers up to firmware version 1.1.50. An authenticated attacker can inject arbitrary commands through the USSD Setup function, potentially gaining remote code execution on the device. The vulnerability requires valid login credentials but does not need user interaction to exploit. Public exploit code is now available.

• CVE-2026-11341MEDIUM 6.3

  D-Link DWR-M920 routers up to firmware version 1.1.50 contain a command injection vulnerability in the IMEI setup form handler. An authenticated attacker can manipulate the IMEI_value parameter to execute arbitrary operating system commands on the affected device. The vulnerability requires valid login credentials but allows remote exploitation without user interaction once authenticated. Public exploit code has been released.

• CVE-2026-11406MEDIUM 6.3

  GL.iNet MT3000 routers running firmware versions up to 4.4.5 contain a command injection flaw in the OpenVPN client import process. An authenticated user can craft a malicious OpenVPN configuration file that, when imported through the web interface, executes arbitrary system commands with the privileges of the router's web service. The vendor has released patched firmware that validates OpenVPN configuration files to block injection attempts.

• CVE-2026-11408MEDIUM 6.3

  A remote code execution vulnerability exists in vertex-app versions up to 2026.02.12, where attackers with user-level access can inject arbitrary operating system commands through the Log Viewer endpoint. The flaw resides in how the application processes user-supplied query parameters without adequate sanitization, allowing an authenticated attacker to execute commands on the underlying server. Public exploit code is available, elevating practical risk despite the moderate CVSS score.

• CVE-2026-11447MEDIUM 6.3

  A command injection vulnerability exists in GL.iNet's GL-MT3000 router firmware versions up to 4.4.5. The flaw is located in the MTK Backend component (iwinfo.so) and can be exploited by an authenticated remote attacker to inject arbitrary commands through the device parameter. This allows an attacker with valid credentials to execute unauthorized system commands. The vendor has released version 4.7 with global protections to intercept malicious injection attempts.

• CVE-2026-11449MEDIUM 6.3

  GL.iNet has patched a command injection vulnerability affecting their GL-MT3000 router running firmware 4.4.5. An authenticated attacker could execute arbitrary commands through the LuCI JSON-RPC interface, potentially compromising the router and devices on its network. The vulnerability is addressed in firmware 4.8.1 and later, though newer versions (4.7.13+) mitigate it by excluding LuCI by default.

• CVE-2026-12219MEDIUM 6.3

  Yealink SIP-T46U phone systems running firmware version 108.86.0.118 contain a command injection vulnerability in their web-based diagnostic interface. An authenticated user can exploit this flaw by manipulating a time parameter to execute arbitrary system commands on the affected device. The vulnerability has been disclosed publicly, meaning attackers have knowledge of how to exploit it. Upgrading to firmware version 108.87.0.23 eliminates the risk.

• CVE-2026-12807MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC V2 running firmware version 1.23. An authenticated attacker can send a specially crafted request to the router's WAN configuration endpoint to inject and execute arbitrary system commands. The vulnerability affects parameters used to configure PPP, PPTP, and L2TP username fields. Because the flaw requires an authenticated session and exploits have already been disclosed publicly, this poses a meaningful risk to organizations running this router model, particularly in environments where internal threat actors or compromised accounts could be leveraged.

• CVE-2026-12808MEDIUM 6.3

  A command injection vulnerability has been discovered in Edimax BR-6478AC V2 running firmware version 1.23. An authenticated attacker can manipulate the 'interface' parameter in a POST request to the /goform/stainfo endpoint to execute arbitrary system commands. The vulnerability requires valid login credentials but poses a meaningful risk to organizations relying on this router model, particularly in environments where user accounts may be compromised or where trust boundaries are weak.

• CVE-2026-12809MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC V2 running firmware 1.23. An authenticated attacker can manipulate the 'newpass' parameter in the wiz_5in1_redirect function to inject arbitrary commands, potentially compromising device integrity and data confidentiality. The vulnerability requires valid login credentials to exploit and is reachable over the network. Public exploit code is available.

• CVE-2026-12810MEDIUM 6.3

  Edimax BR-6478AC V2 routers running firmware 1.23 contain a command injection vulnerability in their web management interface. An authenticated attacker can manipulate input to the mp endpoint and execute arbitrary system commands on the device. The vulnerability requires valid login credentials but no special privileges, and the exploit code is publicly available.

• CVE-2026-12814MEDIUM 6.3

  Comfast CF-WR631AX V3 routers running firmware version 2.7.0.8 and earlier contain a command injection vulnerability in the ping configuration API endpoint. An authenticated attacker can manipulate the destination parameter to execute arbitrary operating system commands on the router. The vulnerability is remotely exploitable and proof-of-concept code has been published, though the vendor has not engaged on the disclosure or released patches.

• CVE-2026-12815MEDIUM 6.3

  A vulnerability in Coolify 4.0.0 allows authenticated users to inject operating system commands through the Image Name Handler component. An attacker with valid login credentials could exploit this to execute arbitrary commands on the server hosting Coolify, potentially compromising the entire deployment platform and any applications it manages. The vendor was notified but has not yet released a public response, though version 4.1.2 includes input validation improvements that likely address this issue.

• CVE-2026-13538MEDIUM 6.3

  A command injection vulnerability exists in Wavlink WL-NU516U1-A M16U1_V240425 routers. An authenticated attacker can send specially crafted POST requests to the wireless configuration endpoint (/cgi-bin/wireless.cgi) with malicious input in SSID or authentication-related parameters. This allows execution of arbitrary system commands with the privileges of the web server process. The vulnerability requires valid credentials to exploit, but the attack surface is wide since SSID and password parameters are commonly modified during normal router administration.

• CVE-2026-13560MEDIUM 6.3

  Edimax EW-7478APC wireless access points running firmware version 1.04 contain a command injection flaw in their web interface. An authenticated attacker can manipulate the 'submit-url' parameter sent to the device's configuration handler to execute arbitrary operating system commands. The vulnerability requires valid login credentials but can be exploited remotely over the network. Public details about this flaw are already available, increasing the risk of active exploitation.

• CVE-2026-13561MEDIUM 6.3

  Edimax EW-7478APC version 1.04 contains a remote command injection vulnerability in its web interface. An authenticated attacker can manipulate the 'rootAPmac' parameter in the formiNICbasic POST request to execute arbitrary operating system commands on the device. The vulnerability has been publicly disclosed, and working exploits are available. The vendor was notified but has not responded or released a patch.

• CVE-2026-13581MEDIUM 6.3

  Edimax EW-7478APC wireless access point models running firmware version 1.04 contain a remote command injection flaw in the device's web interface. An authenticated attacker can send a specially crafted request to the POST handler at /goform/formStaDrvSetup, manipulating the rootAPmac parameter to execute arbitrary operating system commands on the device. This bypasses the device's normal administrative controls and allows an attacker to fully compromise the access point's security.

• CVE-2026-15033MEDIUM 6.3

  CVE-2026-15033 is a command injection vulnerability in the check-peer-dependencies npm package (versions up to 4.3.4) that allows an authenticated attacker to execute arbitrary operating system commands. The flaw exists in the peerDependencies component where user-controlled input is passed unsanitized to a shell execution function, enabling remote code execution for any user with access to the affected package.

• CVE-2026-12223MEDIUM 5.5

  Yealink SIP-T46U IP phones running firmware version 108.86.0.118 contain a command injection vulnerability in their web service that allows authenticated users on the local network to execute arbitrary commands by manipulating network parameters. An attacker with local network access and valid credentials can exploit this flaw to compromise the phone's integrity and confidentiality. A patched firmware version (108.87.0.23) is available, though the vendor notes the fix currently exists only in a technical support branch and has not been publicly released yet.

• CVE-2026-11487MEDIUM 5.3

  Neovim versions up to 0.12.2 contain a command injection vulnerability in the secure.lua module's path-handling function. An authenticated local attacker can manipulate the path argument to execute arbitrary commands with the privileges of the Neovim process. The vulnerability requires local access and user-level privileges, making it a risk primarily in multi-user systems or environments where untrusted users have shell access to machines running Neovim.

• CVE-2026-13501MEDIUM 5.3

  ANTLR4, a widely-used parser generator framework, contains a command injection vulnerability in its Go code generation component. The vulnerability exists in how the GoTarget module processes input when invoking the Go formatter (gofmt). An attacker with local system access can craft malicious input that breaks out of the intended command context, allowing arbitrary command execution with the privileges of the user running ANTLR4. This affects ANTLR4 versions up to and including 4.13.2.

• CVE-2026-15035MEDIUM 5.3

  A command injection vulnerability exists in bentoml OpenLLM 0.6.30 where attackers with local access can manipulate the `cmd` argument passed to the `async_run_command` function, allowing them to execute arbitrary system commands. The vulnerability requires local system access and valid credentials, limiting its immediate threat scope but posing risk to multi-tenant or shared development environments. Public exploit information is available.

• CVE-2026-15193MEDIUM 5.3

  AidanPark's openclaw-android application, in versions up to 0.4.0, contains a local command injection flaw in its Android WebView Bridge component. A user with local access to the device can craft malicious input through the JsBridge.kt interface to execute arbitrary operating system commands with the privileges of the application. While the vulnerability requires local interaction and does not propagate remotely, it could allow an attacker who has already gained a foothold on a device to escalate capabilities or compromise sensitive data accessible to the app.

• CVE-2026-11455MEDIUM 5.0

  MetaGPT versions up to 0.8.2 contain a command injection vulnerability in the common utility module. An authenticated attacker can manipulate the mermaid.path argument to inject arbitrary system commands, potentially leading to unauthorized code execution. The flaw requires significant technical knowledge to exploit and has become public, increasing risk posture for organizations running affected versions.

• CVE-2026-11448MEDIUM 4.7

  GL.iNet GL-MT3000 routers running firmware version 4.4.5 and earlier contain a command injection flaw in the Minidlna service. An authenticated remote attacker can manipulate a specific parameter to inject arbitrary commands, potentially allowing them to execute code on the device. The vulnerability requires administrative privileges to exploit and has been resolved in firmware version 4.7 through enhanced input validation added to the SDK.