CWE-77
3,974 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVEs (3,974)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Npos Tesseract Project 1Npos Tesseract Jun 17, 2026 Aug 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js. |
This affects the package image-tiler before 2.0.2. |
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js. |
This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js. |
1Node Latex Pdf Project 1Node Latex Pdf Jun 17, 2026 Aug 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This affects all versions of package node-latex-pdf. |
This affects all versions of package curljs. |
1Monorepo Build Project 1Monorepo Build Jun 17, 2026 Aug 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This affects all versions of package monorepo-build. |
1Sonicwall 7Sws12 10fpoe Firmware Sws12 8 FirmwareSws12 8poe Firmware+4 moreJun 17, 2026 Jul 29, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earl...Show more |
1Realtek 1Rtl819x Software Development Kit Jun 17, 2026 Jul 28, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface. |
Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces....Show more |
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath) |
The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js. |
This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function. |
1Sonar Wrapper Project 1Sonar Wrapper Jun 17, 2026 Jul 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js. |
1Deferred Exec Project 1Deferred Exec Jun 17, 2026 Jul 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js |
1Google Cloudstorage Commands Project 1Google Cloudstorage Commands Jun 17, 2026 Jul 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 This affects all versions of package google-cloudstorage-commands. |
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js. |
All versions of package git-archive are vulnerable to Command Injection via the exports function. |
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. |
1Abb 7Rmc 100 Lite Firmware Rmc 100 FirmwareUdc Firmware+4 moreJun 17, 2026 Jul 21, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller pro...Show more |