Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 8.8 High severity
SmartFabric OS10 Software: Improper Neutralization of Special Elements used in a Command
Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,
- 8.8 High severity
Microsoft Visual Studio Code CoPilot Chat…: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.
- 7.7 High severity
Outpost Security Suite: Improper Neutralization of Special Elements used in a Command
An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. The manufacturer fixed the vulnerability in version 8.0 (4164.652.1856) from December 17, 2012.
- 8.8 High severity
ManageEngine Applications Manager: Improper Neutralization of Special Elements used in a Command
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
- 7.1 High severity
Looker: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self
- 9.8 Critical severity
Operation and Maintenance Security Management…: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. T
- 9.8 Critical severity
DI-7001 MINI: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The explo
- 9.8 Critical severity
DAP-2695: Improper Neutralization of Special Elements used in an OS Command
A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit
- 9.9 Critical severity
TLS4B Automatic Tank Gauge System: Improper Neutralization of Special Elements used in a Command
The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could
- 8.4 High severity
Socet Gxp: Improper Neutralization of Special Elements used in a Command
An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in cert
- 8.8 High severity
ManageEngine ADManager Plus: Improper Neutralization of Special Elements used in a Command
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
- 9.9 Critical severity
Flowise: Improper Neutralization of Special Elements used in a Command
Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execut
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the
- 9.8 Critical severity
DAP-2695: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This
- 9.3 Critical severity
Microsoft 365 Copilot's Business Chat: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
- 9.3 Critical severity
Microsoft 365 Copilot's Business Chat: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.
- 9.3 Critical severity
Microsoft 365 Word Copilot: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
- 8.8 High severity
AC7: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is no
- 9.8 Critical severity
DesktopCommanderMCP: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack r
- 9.8 Critical severity
DesktopCommanderMCP: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection.
- 7.3 High severity
DIR-852: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and
- 8.1 High severity
deno: Improper Neutralization of Special Elements used in a Command
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a b
- 9.8 Critical severity
DI-7001 MINI: Improper Neutralization of Special Elements used in an OS Command
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been ma
- 7.2 High severity
DI-7100G C1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The att
- 7.2 High severity
IdeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The atta
- 8.8 High severity
F9K1015: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. The exploit is now public and
- 8.8 High severity
F9K1015: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the argument m_wan_ipaddr can lead to command injection. The attack may be performed from remote. The ex
- 8.8 High severity
F9K1015: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing a manipulation of the argument wan_ipaddr can lead to command injection. The attack can be launched remotely. The explo
- 8.8 High severity
MCPHub: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.
- 9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.