Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2016-4991—Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does EPSS 1.8%CVE-2025-1819MEDIUMTenda AC7 1200M telnet TendaTelnet os command injectionEPSS 1.8%CVE-2026-2130MEDIUMBurtTheCoder mcp-maigret search_username index.ts command injectionEPSS 1.8%CVE-2023-27849CRITICALrails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.EPSS 1.8%CVE-2015-10096MEDIUMZarthus IRC Twitter Announcer Bot twitter_announcer.rb get_tweets command injectionEPSS 1.8%CVE-2026-26093HIGHImproper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opdsEPSS 1.8%CVE-2023-25643HIGHTwo Vulnerabilities in Some ZTE Mobile Internet ProductsEPSS 1.8%CVE-2022-29842CRITICALCommand Injection Vulnerability in Western Digital My Cloud devicesEPSS 1.8%CVE-2026-15547MEDIUMShibby Tomato CIFS Mount sub_2D048 os command injectionEPSS 1.8%CVE-2026-9512MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injectionEPSS 1.8%CVE-2026-9533MEDIUMTotolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injectionEPSS 1.8%CVE-2026-15486MEDIUMTRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injectionEPSS 1.8%CVE-2026-9565MEDIUMhaojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injectionEPSS 1.8%CVE-2026-6108MEDIUM1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionEPSS 1.8%CVE-2026-9511MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injectionEPSS 1.8%CVE-2026-19981MEDIUMGL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injectionEPSS 1.8%CVE-2026-19982MEDIUMGL.iNet BE9300/MT6000 Firewall-management RPC os command injectionEPSS 1.8%CVE-2026-77945MEDIUMTRENDnet TEW-821DAP ssi upload.cgi command injectionEPSS 1.8%CVE-2026-9515MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionEPSS 1.8%CVE-2026-15546MEDIUMShibby Tomato start_jffs2 sub_2D568 os command injectionEPSS 1.8%