Fallos del tipo CWE-78

4592 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-58457CRITICALShenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspEPSS 2.9%CVE-2026-37751CRITICALAn OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attacEPSS 2.9%CVE-2026-19188CRITICALHaiwell IoT Cloud HMI Gateway OS Command InjectionEPSS 2.9%CVE-2026-52102CRITICALAn OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commaEPSS 2.9%CVE-2024-53939HIGHAn issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/EPSS 2.9%CVE-2021-21015HIGHMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 2.9%CVE-2012-10046CRITICALE-Mail Security Virtual Appliance learn-msg.cgi Command InjectionEPSS 2.9%CVE-2025-59359CRITICALOS command injection in Chaos Mesh via the cleanTcs mutationEPSS 2.9%CVE-2025-56085HIGHOS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitraEPSS 2.9%CVE-2026-27550HIGHCommand Injection in Field_Shadow_Password ClassEPSS 2.9%CVE-2026-27554HIGHCommand Injection in /index.php/ajax/save_iodd_parametersEPSS 2.9%CVE-2025-27140CRITICALWeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)EPSS 2.9%CVE-2026-27558HIGHCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesEPSS 2.9%CVE-2026-27559HIGHCommand Injection via GET in /api/status/dataEPSS 2.9%CVE-2026-27551HIGHCommand Injection in /index.php/ajax/parameterManageEPSS 2.9%CVE-2026-27548HIGHCommand Injection in /index.php/ajax/get_iodd_port_infoEPSS 2.9%CVE-2026-27547HIGHCommand Injection in /index.php/ajax/get_iodd_menu_infoEPSS 2.9%CVE-2026-27549HIGHCommand Injection in /index.php/attached_devices_tab/do_uploadEPSS 2.9%CVE-2014-0156—Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argumentEPSS 2.9%CVE-2026-26478CRITICALA shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a speciEPSS 2.9%