Fallos del tipo CWE-77
2809 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-7062MEDIUMIntina47 context-sync Git Integration git-integration.ts os command injectionEPSS 2.1%CVE-2026-6130MEDIUMchatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injectionEPSS 2.1%CVE-2026-90690MEDIUM0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injectionEPSS 2.1%CVE-2026-7416MEDIUMPolarVista xcode-mcp-server MCP index.ts run_tests os command injectionEPSS 2.1%CVE-2023-24156CRITICALA command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to executeEPSS 2.1%CVE-2023-24153CRITICALA command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackerEPSS 2.1%CVE-2023-24151CRITICALA command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to EPSS 2.1%CVE-2023-24157CRITICALA command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execuEPSS 2.1%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 2.1%CVE-2021-22938—A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitEPSS 2.1%CVE-2026-25761HIGHCommand injection via crafted filenames in Super-linter ActionEPSS 2.1%CVE-2021-22935—A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitEPSS 2.1%CVE-2020-36642MEDIUMtrampgeek jobe LanguageTask.php run_in_sandbox command injectionEPSS 2.1%CVE-2024-24301HIGHCommand Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with vaEPSS 2.1%CVE-2025-29523HIGHD-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 functionEPSS 2.1%CVE-2024-32353CRITICALTOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSSerEPSS 2.1%CVE-2025-64424CRITICALColify has command injection vulnerability in project git sourceEPSS 2.1%CVE-2020-36650MEDIUMIonicaBizau node-gry command injectionEPSS 2.1%CVE-2025-61787HIGHDeno is Vulnerable to Command Injection on Windows During Batch File ExecutionEPSS 2.1%CVE-2022-21941CRITICALiSTAR UltraEPSS 2.1%