Falhas do tipo CWE-78
4.664 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-34254HIGHRemote inventory task command injection when using ssh command modeEPSS 0.8%CVE-2026-64878CRITICALCommand InjectionEPSS 0.8%CVE-2026-41613HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-42563HIGHDulwich Vulnerable to Command Injection via Merge Driver PathEPSS 0.8%CVE-2025-54084HIGHCalix Gigacenter ONT - Command InjectionEPSS 0.8%CVE-2020-3367MEDIUMCisco Secure Web Appliance Privilege Escalation VulnerabilityEPSS 0.8%CVE-2026-31995MEDIUMOpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster ExtensionEPSS 0.8%CVE-2024-46329HIGHVONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object.EPSS 0.8%CVE-2026-17417HIGHIBM i is Affected By Remote Code Execution Vulnerabilities [, ]EPSS 0.8%CVE-2026-46746HIGHA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input iEPSS 0.8%CVE-2026-78575HIGHLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guardsEPSS 0.8%CVE-2026-17623HIGHLangflow is affected OS Command Injection in Model Context Protocol featuresEPSS 0.8%CVE-2026-18835CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2026-16816CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2026-17642HIGHIBM i is Affected By Remote Code Execution Vulnerabilities [, ]EPSS 0.8%CVE-2026-16906HIGHIBM i is Affected By Multiple Vulnerabilities in Domain Name SystemEPSS 0.8%CVE-2026-82098HIGHDataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareEPSS 0.8%CVE-2024-54008HIGHAuthenticated Remote Code Execution (RCE) in HPE Aruba Networking AirWave Management PlatformEPSS 0.8%CVE-2026-91102HIGHHP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesEPSS 0.8%CVE-2024-11858HIGHRadare2: command injection via pebble application files in radare2EPSS 0.8%