Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2024-32355HIGHTOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSEPSS 1.8%CVE-2020-2508HIGHCommand Injection Vulnerability in QTS and QuTS heroEPSS 1.8%CVE-2024-12985MEDIUMOvertek OT-E801G passwd os command injectionEPSS 1.8%CVE-2023-1456HIGHA vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown pEPSS 1.8%CVE-2023-1457HIGHA vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of theEPSS 1.8%CVE-2026-7642MEDIUMpskill9 website-downloader MCP index.ts download_website os command injectionEPSS 1.8%CVE-2026-4192MEDIUMAvinashBole quip-mcp-server index.ts setupToolHandlers command injectionEPSS 1.8%CVE-2026-7629MEDIUMkleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injectionEPSS 1.8%CVE-2026-79623MEDIUMFishCodeTech Muteki Default Local Worker Backend settings.json os command injectionEPSS 1.8%CVE-2026-15033MEDIUMchristopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injectionEPSS 1.8%CVE-2026-90621MEDIUMipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injectionEPSS 1.8%CVE-2026-82597MEDIUMTOTOLINK NR1800X cstecgi.cgi setUssd command injectionEPSS 1.8%CVE-2026-7730MEDIUMprivsim mcp-test-runner MCP index.ts child_process.spawn os command injectionEPSS 1.8%CVE-2026-75985MEDIUMTRENDnet Router ping.cgi command injectionEPSS 1.8%CVE-2026-6141MEDIUMdanielmiessler Personal_AI_Infrastructure parse_url.ts os command injectionEPSS 1.8%CVE-2026-5327MEDIUMefforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injectionEPSS 1.8%CVE-2026-75984MEDIUMTRENDnet TEW-823DRU admin.cgi command injectionEPSS 1.8%CVE-2026-75011MEDIUMkylecui NetForensicMCP index.js execAsync command injectionEPSS 1.8%CVE-2026-76591MEDIUMTRENDnet TEW-755AP ssi email.cgi log_email_server command injectionEPSS 1.8%CVE-2026-5831MEDIUMAgions taskflow-ai terminal_execute handlers.ts os command injectionEPSS 1.8%