Fallos del tipo CWE-78

4627 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-65090HIGHNVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A suEPSS 1.3%CVE-2022-35975CRITICALImproper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCodeEPSS 1.3%CVE-2025-3363CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.3%CVE-2026-26029HIGHsf-mcp-server has a Command Injection in query_records tool due to unsafe use of child_process.execEPSS 1.3%CVE-2025-48501CRITICALAn OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commanEPSS 1.3%CVE-2023-34420HIGHA valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web EPSS 1.3%CVE-2025-3361CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.3%CVE-2025-3362CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.3%CVE-2025-54994CRITICAL@akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` APIEPSS 1.3%CVE-2026-10214MEDIUMzhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injectionEPSS 1.3%CVE-2026-10219MEDIUMnextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionEPSS 1.3%CVE-2026-0757HIGHMCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape VulnerabilityEPSS 1.3%CVE-2021-47745HIGHCypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection via Firmware UpgradeEPSS 1.3%CVE-2023-6398HIGHA post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37EPSS 1.3%CVE-2022-22991HIGHCommand injection through unsecured HTTP calls on Western Digital My Cloud devicesEPSS 1.3%CVE-2022-20652MEDIUMCisco Tetration Command Injection VulnerabilityEPSS 1.3%CVE-2009-20010CRITICALDogfood CRM spell.php RCEEPSS 1.3%CVE-2025-8748HIGHOS command injection in MiR robots and MiR fleet via crafted HTTP requestsEPSS 1.3%CVE-2025-34280HIGHNagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal FunctionEPSS 1.3%CVE-2026-41880CRITICALOS Command Injection in R-SOFT DMSEPSS 1.3%