Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2026-6219MEDIUMaandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injectionEPSS 1.4%CVE-2024-42507CRITICALUnauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolEPSS 1.4%CVE-2024-42506CRITICALUnauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolEPSS 1.4%CVE-2026-4496MEDIUMsigmade Git-MCP-Server gitUtils.ts child_process.exec os command injectionEPSS 1.4%CVE-2024-3154HIGHCri-o: arbitrary command injection via pod annotationEPSS 1.4%CVE-2026-44866HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-44870HIGHAuthenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating SystemsEPSS 1.4%CVE-2026-44868HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-44869HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-44871HIGHAuthenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating SystemsEPSS 1.4%CVE-2026-44867HIGHAuthenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10EPSS 1.4%CVE-2026-5621MEDIUMChrisChinchilla Vale-MCP HTTP index.ts os command injectionEPSS 1.4%CVE-2026-8210MEDIUMaandrew-me tgpt Update helper.go helper.Update command injectionEPSS 1.4%CVE-2026-5619MEDIUMBraffolk mcp-summarization-functions summarize_command mcp-server.ts os command injectionEPSS 1.4%CVE-2024-27980HIGHDue to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject aEPSS 1.4%CVE-2026-21518HIGHGitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityEPSS 1.4%CVE-2023-33486CRITICALTOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerabilEPSS 1.4%CVE-2023-33487CRITICALTOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulneraEPSS 1.4%CVE-2020-26300MEDIUMCommand injection in systeminformationEPSS 1.4%CVE-2024-11861CRITICALCommand injection in EnerSys AMPA 22.09 and prior versionsEPSS 1.4%