Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 9.8 Critical severity
Di-7400g+ Firmware: Improper Neutralization of Special Elements used in a Command
The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the param
- 9.8 Critical severity
Smart 2k+ Plug-in Wi-fi Video Doorbell With…: Improper Neutralization of Special Elements used in a Command
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system() function.
- 8.7 High severity
AK-SM8xxA Series: Improper Neutralization of Special Elements used in a Command
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
- 7.5 High severity
EdgeMAX EdgeSwitch: Improper Neutralization of Special Elements used in a Command
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network. Affected Products: EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) Mitigation: Upda
- 9.8 Critical severity
UniFi Connect EV Station Lite: Improper Neutralization of Special Elements used in a Command
Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite. Affected Products: UniFi Connect EV Station Lite (Version 1.5.1 and
- 8.1 High severity
mcp-cli: Improper Neutralization of Special Elements used in an OS Command
A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack i
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaticRoute of the file /goform/addStaticRoute. Such man
- 7.8 High severity
shc: Improper Neutralization of Special Elements used in an OS Command
A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Handler. The manipulation results in os command injection. The attack is only possible with local access.
- 7.8 High severity
shc: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src/shc.c of the component Filename Handler. Executing manipulation can lead to os command injection. The attack can only be executed locally.
- 7.2 High severity
server-side backend for Site Tracking: Improper Neutralization of Input During Web Page Generation
The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking. NOTE: a customer does not need to take any action to update locally installed software (such as Adform Site Track
- 9.8 Critical severity
WL-NU516U1: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely
- 9.8 Critical severity
screenshot-desktop: Improper Neutralization of Special Elements used in a Command
screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without san
- 9.8 Critical severity
A3002r Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.
- 7.2 High severity
aiven-db-migrate: Improper Neutralization of Special Elements used in a Command
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases during a migration from an untrusted source server. The vulnerability stems from
- 9.8 Critical severity
AC20: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit
- 9.8 Critical severity
DIR-860L: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads to os command injection. It is possible to initiate the atta
- 8.8 High severity
DIR‑818L: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disc
- 8.8 High severity
N350R: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the p
- 7.8 High severity
Microsoft Visual Studio 2022 version 17.14: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of the file /goform/setWan. The manipulation of the argument Hostname leads to os command injection. Th
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_red of the file /goform/RP_setBasicAuto. The manipulation of the argument hname leads to os command in
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /goform/setIpv6. The manipulation of the argument Ipv6PriDns/Ipv6SecDns/Ipv6StaticGateway/LanIpv6Addr/LanPr
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function um_inspect_cross_band of the file /goform/RP_setBasicAuto. The manipulation of the argument staticGateway leads to os command
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function RP_setBasicAuto of the file /goform/RP_setBasicAuto. The manipulation of the argument staticIp/staticNetmask leads to os comma
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setDeviceName of the file /goform/setDeviceName. The manipulation of the argument DeviceName leads to os comma
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function RP_setBasic of the file /goform/RP_setBasic. The manipulation of the argument bssid leads to os command injection. The a
- 8.8 High severity
RE6250: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSetting of the file /goform/setLan. The manipulation of the argument lanNetmask/lanIp leads to os command i
- 9.8 Critical severity
spring-shiro-training: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in wangzhixuan spring-shiro-training up to 94812c1fd8f7fe796c931f4984ff1aa0671ab562. It has been declared as critical. This vulnerability affects unknown code of the file /role/add. The manipulation leads to command injection. The att
- 8.7 High severity
Cloud Connect Advanced: Improper Neutralization of Special Elements used in a Command
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this ena
- 9.8 Critical severity
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection…
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pr
- 7.5 High severity
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a…
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.
- 8.8 High severity
nest: Improper Neutralization of Special Elements used in a Command
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local
- 9.8 Critical severity
1Panel: Improper Neutralization of Special Elements used in a Command
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate ver
- 8.8 High severity
cursor: Improper Neutralization of Special Elements used in a Command
Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal ca
- 9.8 Critical severity
Rx 1500 Firmware: Improper Neutralization of Special Elements used in a Command
An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.
- 9.8 Critical severity
VaelsysV4: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_server.php of the component Web interface. Such manipulation of the argument xajaxargs leads to os comm
- 9.8 Critical severity
X15: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads t
- 9.1 Critical severity
branch-names: Improper Neutralization of Special Elements used in a Command
tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action
- 9.4 Critical severity
Home Kit Firmware: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to intercept
- 7.8 High severity
Roo-Code: Improper Neutralization of Special Elements used in a Command
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack p