#Command Injection
All CosmicBytez Labs articles tagged #Command Injection, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-110957: Critical OS Command Injection in Wavlink WL-WN530BE2-A Routers
A maximum-severity CVSS 10.0 flaw lets unauthenticated attackers run OS commands on Wavlink WL-WN530BE2-A routers via the REMOTE_ADDR parameter.
- Security
CVE-2026-109110: Wavlink WL-WN592AX6 Unauthenticated OS Command Injection
A critical, unauthenticated command injection in Wavlink WL-WN592AX6 routers lets remote attackers run arbitrary OS commands as root.
- Security
CVE-2025-71429: GPT-SoVITS Output Path OS Command Injection
Unauthenticated attackers can inject shell commands via GPT-SoVITS' UVR5 WebUI output-folder field, achieving full remote code execution.
- Security
CVE-2026-105793: Command Injection in Microsoft UFO's Mobile MCP Server via Unsanitized ADB Key Codes
A flaw in Microsoft UFO's mobile MCP server lets attackers inject arbitrary ADB shell commands on connected Android devices.
- Security
CVE-2026-105134: AhsayCBS Replication Receiver OS Command Injection
A maximum-severity command injection flaw in AhsayCBS's Replication Receiver API lets attackers run arbitrary OS commands remotely.
- News
Fortra Patches Critical Vulnerabilities in BoKS
Fortra fixed 8 BoKS flaws, including a 9.9 CVSS AD auth bypass, 9.1 root command injection, and 9.8 remote buffer overflow bug.
- Security
CVE-2026-79898: Authenticated Command Injection to Root in Fortra BoKS Manager
An authenticated user who can add CRL URLs in Fortra BoKS Manager can trigger shell command injection, executing as root on the BoKS Master.
- Security
CVE-2026-101075: Netcore NR289-GE Unauthenticated OS Command Injection
A critical OS command injection in Netcore NR289-GE routers lets unauthenticated attackers execute root commands via location_time.cgi.
- Security
CVE-2026-101076: Netcore NR289-GE Router Unauthenticated OS Command Injection
A critical, unauthenticated OS command injection in Netcore NR289-GE routers has a public exploit, letting remote attackers run commands as root.
- Security
CVE-2026-101187: Ziroom ZHOME A0101 Command Injection via USB Device Management API
A high-privilege command injection flaw in Ziroom ZHOME A0101's USB Device Management API allows OS command execution via a crafted path argument.
- Security
CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
An unauthenticated command injection in Netcore NBR200V2's traceroute tool lets attackers run arbitrary commands as root via ubus JSON-RPC.
- Security
CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
Netcore NBR200V2 routers are vulnerable to unauthenticated command injection via the ipv4 argument in the LAN IP configuration handler.
- Security
CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
A third command injection flaw in Netcore NBR200V2's network_tools CGI endpoint lets remote attackers run arbitrary shell commands unauthenticated.
- Security
CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
Netcore NBR200V2's firmware upgrade CGI endpoint injects the QUERY_STRING argument into a shell command, enabling unauthenticated remote injection.
- Security
CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
The restore.cgi backup-restore endpoint on Netcore NBR200V2 routers is vulnerable to unauthenticated command injection via QUERY_STRING.
- Security
CVE-2026-93742: Totolink A3002MU Command Injection via formWsc
Public PoC exploits an unauthenticated command injection in Totolink A3002MU's WPS handler, giving remote attackers root on the router.
- Security
CVE-2026-93958: D-Link R95 (BE9500) Command Injection to Root RCE
A public PoC chains D-Link R95 BE9500 firmware 1.00.16's SetTimeSettings handler into authenticated command injection for root shell access.
- Security
CVE-2026-55158: Conflibot Command Injection via Pull Request Branch Name
Conflibot before 1.2.1 interpolates attacker-controlled PR branch names into shell commands, enabling RCE with repo secrets and a write-scoped GitHub token.
- Security
CVE-2026-89010: WAVLINK Router Unauthenticated Root Command Injection
A critical OS command injection in WAVLINK WN535M1/WN535M3 routers lets unauthenticated attackers run root commands via sync_server.
- Security
CVE-2026-79697: Advantech WISE-6610 Unauthenticated Command Injection
A CVSS 9.9 command injection flaw in Advantech WISE-6610 industrial gateways lets remote attackers run arbitrary OS commands; a public exploit exists.
- Security
CVE-2026-85222: D-Link DNS-340L Command Injection Has No Fix Coming
An unauthenticated OS command injection in the DNS-340L's Add-On Center CGI grants root — and D-Link has declared the device end-of-life.
- News
Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks
SonicWall confirms active exploitation of two chained SMA 1000 zero-days — a pre-auth SSRF (CVSS 10.0) and post-auth command injection.
- Security
CVE-2026-79408: MetaGPT OS Command Injection Vulnerability
MetaGPT 0.8.1 fails to sanitize a path argument in its repo-parsing code, letting attackers run arbitrary OS commands via RepoParser.
- Security
CVE-2026-77533: UniFi Protect Command Injection via Improper Input Validation
A critical flaw in UniFi Protect lets a low-privileged, network-adjacent attacker inject OS commands on the host device. Patch to 7.2.105+.
- Security
CVE-2026-78211: Critical OS Command Injection in 4MOSAn GCB Doctor
A CVSS 9.8 critical unauthenticated RCE vulnerability in 4MOSAn GCB Doctor exposes systems to full OS command injection via an unremoved ADOdb test page.
- News
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Cycode found chained flaws in NASA's open-source AMMOS Instrument Toolkit GUI allowing unauthenticated attackers to send arbitrary spacecraft commands.
- Security
CVE-2026-53545: Termix SSH Tunnel Command Injection — CVSS 9.8 Critical
Critical OS command injection in Termix's SSH tunnel teardown lets authenticated attackers execute arbitrary OS commands on hosts. Patch to 2.3.2.
- Security
CVE-2026-50523: Microsoft PowerShell Local Command Injection Vulnerability
A command injection flaw in Microsoft PowerShell allows authorized local attackers to execute arbitrary code via improper input neutralization.
- Security
SonicWall GMS Unauthenticated Command Injection RCE
A critical unauthenticated command injection flaw in SonicWall GMS 9.5.1 and earlier allows remote attackers to execute arbitrary code via crafted requests.
- Security
CVE-2026-19348: Critical Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater
A CVSS 9.8 critical command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater allows unauthenticated remote attackers to execute...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Quectel)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Fibocom)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via Ping Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host parameter...
- Security
D-Link DWR-M961 Command Injection via Traceroute Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host and ipVer...
- Security
CVE-2026-71948: D-Link DWR-M961 Command Injection via formDebugDiagnosticRun
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers allows remote attackers to execute arbitrary commands via the host...
- Security
CVE-2026-71949: D-Link DWR-M961 Command Injection via formUSSDSetup
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers enables remote code execution through the ussdValue and...
- Security
CVE-2026-71950: D-Link DWR-M961 Command Injection via formSmsManage
A critical unauthenticated command injection in the D-Link DWR-M961 SMS management interface allows remote attackers to execute arbitrary OS commands via...
- Security
CVE-2026-71951: D-Link DWR-M961 Command Injection via formIMEISetup
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers allows remote code execution by injecting OS commands into the...
- Security
MSI Radix AXE6600 Critical Command Injection in WPS Interface (CVE-2026-71983)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's wps.cgi interface allows remote attackers to execute arbitrary...
- Security
MSI Radix AXE6600 Critical Command Injection in URL Filter Function (CVE-2026-71984)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's urlfilter function allows remote attackers to execute arbitrary...
- Security
MSI Radix AXE6600 Critical Command Injection in Access Control Function (CVE-2026-71985)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's accesscontrol function enables remote attackers to execute arbitrary...
- Security
MSI Radix AXE6600 Critical Command Injection in DMZ Function (CVE-2026-71986)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's DMZ function allows remote attackers to execute arbitrary commands...
- Security
CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability
Critical unauthenticated command injection in Progress LoadMaster lets attackers run arbitrary OS commands. Listed on the CISA KEV catalog — patch immediately.
- Security
CVE-2026-61515: Puwell IP Camera Unauthenticated Command Injection
A critical unauthenticated command injection vulnerability in Puwell IP Camera firmware 2.x through 4.x allows remote attackers to execute arbitrary OS...
- Security
CVE-2026-66902: Google::Auth Perl Library RCE via Credential JSON Injection
Google::Auth for Perl versions before 0.06 passes attacker-controlled commands from external_account credentials JSON directly to system(), enabling...
- Security
CVE-2026-18602: GL.iNet GL-MT3000 Remote Command Injection via VPN Hostname
A critical command injection vulnerability in GL.iNet GL-MT3000 routers (firmware up to 4.4.5) allows remote attackers to execute arbitrary OS commands by...
- Security
CVE-2026-6837: Zyxel WAX650S Post-Auth Command Injection (CVSS 7.2)
A post-authentication command injection vulnerability in the Zyxel WAX650S Wi-Fi 6 access point allows authenticated administrators to execute arbitrary...
- News
Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Arista Networks has released an emergency patch for a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator deployments that...
- Security
CVE-2026-61445: PraisonAI AICoder Arbitrary File Write and Command Injection via LLM Tool Calls
A CVSS 9.9 critical vulnerability in PraisonAI before 4.6.78 allows attackers to write files to arbitrary filesystem locations and execute arbitrary OS...
- Security
CVE-2026-34038: Critical Coolify RCE via Authenticated Command Injection (CVSS 9.9)
A critical command injection vulnerability in Coolify's deployment pipeline allows any authenticated user with write access to execute arbitrary OS...
- Security
CVE-2026-40047: Apache Camel Docling Argument Injection Enables OS Command Execution
A critical argument injection vulnerability in Apache Camel's camel-docling component allows attackers to inject arbitrary CLI arguments into the docling...
- Security
UniFi Connect Critical RCE via Command Injection CVE-2026-50746
A maximum-severity command injection vulnerability in Ubiquiti's UniFi Connect Application allows any network-accessible attacker to execute arbitrary OS...
- Security
UniFi Access Application Command Injection RCE CVE-2026-50748
An improper input validation flaw in Ubiquiti's UniFi Access Application enables low-privileged network attackers to inject OS commands and execute...
- Security
CVE-2026-12486: GeoVision GV-I/O Box 4E OS Command Injection via libNetSetObj.so
Multiple OS command injection vulnerabilities in GeoVision GV-I/O Box 4E firmware 2.09 allow attackers with network access to execute arbitrary system...
- Security
CVE-2025-67038: Lantronix EDS5000 OS Command Injection Vulnerability
A critical OS command injection flaw in the Lantronix EDS5000 serial device server allows unauthenticated attackers to inject arbitrary commands via the...
- Security
CVE-2026-47367: UID Enterprise Agent Command Injection via Improper Input Validation
A critical CVSS 9.9 command injection vulnerability in UID Enterprise Agent allows a low-privileged network attacker to execute arbitrary commands on the...
- Security
CVE-2026-47370: UniFi OS Command Injection via Improper Input Validation
A critical CVSS 9.9 command injection vulnerability in Ubiquiti UniFi OS allows a low-privileged network attacker to execute arbitrary commands within...
- Security
CVE-2026-49185: FieldX MDM ADB Topic Command Injection via Runtime.exec()
A critical CVSS 9.8 command injection vulnerability in the FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), enabling…
- Security
CVE-2026-49188: ai_cmd Utility Root-Level popen() Injection via Socket Input
A critical CVSS 9.8 vulnerability in the ai_cmd utility executes with full root permissions and pipes socket inputs directly to popen(), enabling…
- Security
UniFi OS Command Injection via Improper Input Validation
A CVSS 9.1 command injection vulnerability in UniFi OS devices allows a network-adjacent attacker with high privileges to execute arbitrary commands on...
- Security
CVE-2026-34910 — UniFi OS Unauthenticated Command Injection
A CVSS 10.0 command injection vulnerability in UniFi OS allows any network-accessible attacker with no credentials to execute arbitrary OS commands,...
- Security
CVE-2026-5433: Honeywell CNM Critical Command Injection RCE
A CVSS 9.1 critical command injection vulnerability in Honeywell's Control Network Module web interface allows remote attackers to execute arbitrary...
- Security
CVE-2026-25244 — WebdriverIO Command Injection RCE via Git
A command injection vulnerability in WebdriverIO below version 9.24.0 allows remote code execution through malicious git branch names containing shell...
- Security
CVE-2026-41500: electerm macOS Command Injection via Install Script
A critical command injection vulnerability in the electerm terminal client allows remote attackers to achieve unauthenticated code execution on macOS...
- Security
CVE-2026-41501: electerm Linux Command Injection via Install Script
A critical command injection flaw in electerm's Linux installer allows remote attackers to execute arbitrary shell commands by injecting into unsanitized...
- Security
CVE-2026-36841: TOTOLINK N200RE V5 Command Injection
A critical CVSS 9.8 command injection vulnerability in TOTOLINK N200RE V5 allows unauthenticated remote code execution via the macstr and bandstr...
- Security
CVE-2026-30352: Remote Code Execution in leonvanzyl
A critical remote code execution vulnerability in the /devserver/start endpoint of the leonvanzyl autocoder AI coding tool allows unauthenticated...
- Security
CVE-2026-7037: Unauthenticated OS Command Injection in Totolink A8000RU
A critical CVSS 9.8 OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2025-29635: D-Link DIR-823X Command Injection
A command injection flaw in end-of-life D-Link DIR-823X routers allows authenticated remote attackers to execute arbitrary OS commands. CISA has added...
- Security
CVE-2026-6951: simple-git RCE via --config Option Bypass
A critical remote code execution vulnerability in the simple-git npm package allows attackers to inject arbitrary git config options via the --config...
- Security
CVE-2026-6942: radare2-mcp OS Command Injection via Shell
A critical OS command injection vulnerability in radare2-mcp 1.6.0 and earlier allows remote attackers to execute arbitrary commands by bypassing the...
- Security
CVE-2026-6112: Totolink A7100RU OS Command Injection via setRadvdCfg
A critical OS command injection vulnerability (CVSS 9.8) in Totolink A7100RU firmware allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2026-6113: Totolink A7100RU OS Command Injection via setTtyServiceCfg
A critical OS command injection flaw (CVSS 9.8) in Totolink A7100RU enables remote unauthenticated attackers to execute arbitrary commands by manipulating...
- Security
CVE-2026-6114: Totolink A7100RU OS Command Injection via setNetworkCfg
CVE-2026-6114 is a critical OS command injection vulnerability (CVSS 9.8) in the Totolink A7100RU router's setNetworkCfg function, exploitable remotely...
- Security
CVE-2026-6115: Totolink A7100RU OS Command Injection via setAppCfg
CVE-2026-6115 describes a critical OS command injection vulnerability (CVSS 9.8) in the Totolink A7100RU router, exploitable remotely and without...
- Security
CVE-2021-4473: Tianxin Behavior Management System
A critical unauthenticated command injection vulnerability in the Tianxin Internet Behavior Management System's Reporter component allows attackers to...
- Security
CVE-2026-0596: MLflow Command Injection via Unsanitized
A critical command injection vulnerability in mlflow/mlflow allows attackers to execute arbitrary shell commands by embedding metacharacters in the...
- Security
CVE-2025-15379: MLflow Command Injection in Model Serving
A maximum-severity command injection vulnerability in MLflow's model serving container initialization allows attackers to execute arbitrary OS commands...
- Security
CVE-2026-32238: Critical Command Injection in OpenEMR
OpenEMR versions prior to 8.0.0.2 contain a CVSS 9.1 command injection vulnerability in the backup functionality. Authenticated attackers with high...
- Security
CVE-2025-69902: Critical Command Injection in kubectl-mcp-server
A critical command injection vulnerability in kubectl-mcp-server allows unauthenticated attackers to execute arbitrary OS commands through unsanitized...
- Security
CISA Adds Actively Exploited VMware Aria Operations RCE
CISA has added CVE-2026-22719, a high-severity command injection vulnerability in VMware Aria Operations allowing unauthenticated remote code execution,...
- Security
Soliton FileZen OS Command Injection Under Active
A high-severity OS command injection vulnerability in Soliton Systems FileZen secure file transfer appliances is being actively exploited. Authenticated...
- Security
GitHub Copilot Command Injection Flaws Enable Remote Code
Multiple high-severity command injection vulnerabilities discovered in GitHub Copilot extensions for VS Code, Visual Studio, and JetBrains could allow...