Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2022-0365CRITICALRicon Mobile, Inc.EPSS 2.2%CVE-2024-21756HIGHA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thEPSS 2.2%CVE-2026-90843MEDIUMSabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injectionEPSS 2.2%CVE-2026-4497MEDIUMTotolink WA300 cstecgi.cgi recvUpgradeNewFw os command injectionEPSS 2.2%CVE-2026-82668MEDIUMklaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injectionEPSS 2.2%CVE-2026-86330HIGHNoobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internalEPSS 2.2%CVE-2025-15061CRITICALFramelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution VulnerabilityEPSS 2.2%CVE-2026-8923HIGHRemote Code ExecutionEPSS 2.2%CVE-2024-32351HIGHTOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mruEPSS 2.2%CVE-2021-41243CRITICALOS Command Injection Vulnerability and Potential Zip Slip VulnerabilityEPSS 2.2%CVE-2022-47208HIGHThe “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticEPSS 2.2%CVE-2022-3874HIGHOs command injection via ct_command and fcct_commandEPSS 2.2%CVE-2022-45043HIGHTenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.EPSS 2.2%CVE-2026-86396HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 2.2%CVE-2026-94349HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.2%CVE-2019-12811—ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraEPSS 2.2%CVE-2025-43879CRITICALWRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilitEPSS 2.2%CVE-2024-43654CRITICALAuthenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationEPSS 2.2%CVE-2024-43653CRITICALAuthenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationEPSS 2.2%CVE-2025-48890CRITICALWRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilitEPSS 2.2%