Fallos del tipo CWE-78

4668 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2021-34722MEDIUMCisco IOS XR Software Command Injection VulnerabilitiesEPSS 0.3%CVE-2021-34721MEDIUMCisco IOS XR Software Command Injection VulnerabilitiesEPSS 0.3%CVE-2026-102828CRITICALsimple-git unsafe-operation guard does not block trailer command configurationEPSS 0.3%CVE-2026-102829CRITICALsimple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionEPSS 0.3%CVE-2021-21527MEDIUMDell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerabiEPSS 0.3%CVE-2026-14275MEDIUMIBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesEPSS 0.3%CVE-2021-21550MEDIUMDell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulneEPSS 0.3%CVE-2026-14276MEDIUMIBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesEPSS 0.3%CVE-2026-34982HIGHVim modeline bypass via various options affects Vim < 9.2.0276EPSS 0.3%CVE-2022-1356HIGHCambium Networks cnMaestro use of Potentially Dangerous FunctionEPSS 0.3%CVE-2020-25859—The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validatinEPSS 0.3%CVE-2024-37678MEDIUMCross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker tEPSS 0.3%CVE-2025-33234HIGHNVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead tEPSS 0.3%CVE-2026-32948MEDIUMsbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on WindowsEPSS 0.3%CVE-2026-55582HIGHmcp-shell: Secure Mode Allowlist Bypass via Git Shell AliasEPSS 0.3%CVE-2026-84967MEDIUMArbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminalEPSS 0.3%CVE-2025-43858CRITICALYoutubeDLSharp allows command injection on windows system due to non sanitized argumentsEPSS 0.3%CVE-2025-47780MEDIUMcli_permissions.conf: deny option does not work for disallowing shell commandsEPSS 0.3%CVE-2025-41225HIGHVMware vCenter Server authenticated command-execution vulnerabilityEPSS 0.3%CVE-2026-43991HIGHJunoClaw: plugin-shell shell-injection bypass via substring blocklistEPSS 0.3%