Weaknesses of type CWE-77

2,809 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2026-7062MEDIUMIntina47 context-sync Git Integration git-integration.ts os command injectionEPSS 2.1%CVE-2026-6130MEDIUMchatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injectionEPSS 2.1%CVE-2026-90690MEDIUM0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injectionEPSS 2.1%CVE-2026-7416MEDIUMPolarVista xcode-mcp-server MCP index.ts run_tests os command injectionEPSS 2.1%CVE-2023-24156CRITICALA command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to executeEPSS 2.1%CVE-2023-24153CRITICALA command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackerEPSS 2.1%CVE-2023-24151CRITICALA command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to EPSS 2.1%CVE-2023-24157CRITICALA command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execuEPSS 2.1%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 2.1%CVE-2021-22938—A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitEPSS 2.1%CVE-2026-25761HIGHCommand injection via crafted filenames in Super-linter ActionEPSS 2.1%CVE-2021-22935—A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitEPSS 2.1%CVE-2020-36642MEDIUMtrampgeek jobe LanguageTask.php run_in_sandbox command injectionEPSS 2.1%CVE-2024-24301HIGHCommand Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with vaEPSS 2.1%CVE-2025-29523HIGHD-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 functionEPSS 2.1%CVE-2024-32353CRITICALTOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSSerEPSS 2.1%CVE-2025-64424CRITICALColify has command injection vulnerability in project git sourceEPSS 2.1%CVE-2020-36650MEDIUMIonicaBizau node-gry command injectionEPSS 2.1%CVE-2025-61787HIGHDeno is Vulnerable to Command Injection on Windows During Batch File ExecutionEPSS 2.1%CVE-2022-21941CRITICALiSTAR UltraEPSS 2.1%