Weaknesses of type CWE-78

5,063 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2026-93349HIGHFrictionless OS Command Injection via explore Console CommandEPSS 2.1%CVE-2025-6103HIGHWifi-soft UniBox Controller test_accesscodelogin.php os command injectionEPSS 2.1%CVE-2019-25158MEDIUMpedroetb tts-api app.js onSpeechDone os command injectionEPSS 2.1%CVE-2021-1487HIGHCisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Command Injection VulnerabilityEPSS 2.1%CVE-2026-90690MEDIUM0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injectionEPSS 2.1%CVE-2026-76761MEDIUMchenhg5 cc-connect Management API engine.go shellExecCommand os command injectionEPSS 2.1%CVE-2026-14802MEDIUMreact create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injectionEPSS 2.1%CVE-2024-48632HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAdEPSS 2.1%CVE-2022-45977HIGHTenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.EPSS 2.1%CVE-2024-48633HIGHD-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPEPSS 2.1%CVE-2026-4627HIGHD-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injectionEPSS 2.1%CVE-2025-29631CRITICALGardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow commandEPSS 2.1%CVE-2023-22365HIGHAn OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially EPSS 2.1%CVE-2026-102031CRITICALJunos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabledEPSS 2.1%CVE-2026-19628HIGHRemote Code ExecutionEPSS 2.1%CVE-2026-52356HIGHAn OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to executEPSS 2.1%CVE-2026-79408CRITICALAn OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.EPSS 2.1%CVE-2026-2629MEDIUMjishi node-sonos-http-api TTS Provider mac-os.js Promise os command injectionEPSS 2.1%CVE-2026-49869CRITICALKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`EPSS 2.1%KEVCVE-2026-25037HIGHCopeland XWEB and XWEB Pro OS Command InjectionEPSS 2.1%