Weaknesses of type CWE-77

2,810 results

Injeção de comando por entrada não neutralizada

O software monta um comando (shell, sistema operacional ou aplicação) usando dados recebidos de fora (entrada do usuário, API, banco de dados) sem remover ou neutralizar caracteres especiais que alteram a semântica do comando. Isso permite que um atacante injete comandos arbitrários que serão executados com as permissões da aplicação.

Example

Um script PHP que executa ping com o IP fornecido pelo usuário: `system('ping ' . $_GET['ip'])`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, porque o ponto-e-vírgula não foi escapado e o shell interpreta dois comandos sequenciais.

How to mitigate

Use APIs seguras que não envolvem interpretação de shell (ex: ProcessBuilder em Java, subprocess.run com shell=False em Python). Se imperativo usar shell, valide com whitelist rigorosa (apenas caracteres alfanuméricos/IPs válidos) e escape com funções específicas da linguagem (escapeshellarg em PHP, shlex.quote em Python).

CVE-2026-6219MEDIUMaandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injectionEPSS 1.4%CVE-2024-42507CRITICALUnauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolEPSS 1.4%CVE-2024-42506CRITICALUnauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolEPSS 1.4%CVE-2026-4496MEDIUMsigmade Git-MCP-Server gitUtils.ts child_process.exec os command injectionEPSS 1.4%CVE-2024-3154HIGHCri-o: arbitrary command injection via pod annotationEPSS 1.4%CVE-2026-44866HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-44870HIGHAuthenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating SystemsEPSS 1.4%CVE-2026-44868HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-44869HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-44871HIGHAuthenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating SystemsEPSS 1.4%CVE-2026-44867HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-5621MEDIUMChrisChinchilla Vale-MCP HTTP index.ts os command injectionEPSS 1.4%CVE-2026-8210MEDIUMaandrew-me tgpt Update helper.go helper.Update command injectionEPSS 1.4%CVE-2026-5619MEDIUMBraffolk mcp-summarization-functions summarize_command mcp-server.ts os command injectionEPSS 1.4%CVE-2024-27980HIGHDue to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject aEPSS 1.4%CVE-2026-21518HIGHGitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityEPSS 1.4%CVE-2023-33486CRITICALTOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerabilEPSS 1.4%CVE-2023-33487CRITICALTOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulneraEPSS 1.4%CVE-2020-26300MEDIUMCommand injection in systeminformationEPSS 1.4%CVE-2024-11861CRITICALCommand injection in EnerSys AMPA 22.09 and prior versionsEPSS 1.4%