Falhas do tipo CWE-78
4.604 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2026-19983MEDIUMGL.iNet XE3000 NAS Command Service gl_nas_sys os command injectionEPSS 2.1%CVE-2026-5012MEDIUMelecV2 elecV2P rpc pm2run os command injectionEPSS 2.1%CVE-2026-7064MEDIUMAgentDeskAI browser-tools-mcp browser-connector.ts os command injectionEPSS 2.1%CVE-2026-7220MEDIUMjackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injectionEPSS 2.1%CVE-2026-30877CRITICALbaserCMS: OS Command Injection in the baserCMS Update FunctionalityEPSS 2.1%CVE-2021-32531CRITICALQSAN XEVO - Command Injection Following via Init functionEPSS 2.1%CVE-2026-95675CRITICALD-Link DAP-1360 6.14 Unauthenticated RCE via Web Management InterfaceEPSS 2.1%CVE-2026-8603HIGHImproper neutralization of special elements used in an OS command ('OS command injection') in ScadaBREPSS 2.1%CVE-2026-42168CRITICALdjango-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields EPSS 2.1%CVE-2025-56084HIGHOS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands EPSS 2.1%CVE-2026-93349HIGHFrictionless OS Command Injection via explore Console CommandEPSS 2.0%CVE-2017-6712—A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privilegesEPSS 2.0%CVE-2026-59800CRITICAL9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install EndpointEPSS 2.0%CVE-2026-82082CRITICALGreen-Computing｜NUMail - OS Command InjectionEPSS 2.0%CVE-2026-78211CRITICAL4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command InjectionEPSS 2.0%CVE-2026-65711HIGHsysPass 3.2.11 Authenticated OS Command Injection via Backup PathEPSS 2.0%CVE-2024-45888HIGHDrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainEPSS 2.0%CVE-2021-1602HIGHCisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution VulnerabilityEPSS 2.0%CVE-2020-27861HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. AEPSS 2.0%CVE-2026-47359HIGHApache CloudStack: OS Command Injection due to unsanitized mount commandEPSS 2.0%