CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

segmented-pentest-lab

Segmented Pentest Lab A self-built, Docker-based segmented ne...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the process.run function during Liquidsoap configuration generation for live recording. An attacker can execute arbitrary system commands by supplying a specially crafted streamer username containing shell...

CVE-2026-100852

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

EUVD-2026-87836

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852

AzuraCast versions through 0.23.x are vulnerable to a command injection vulnerability within the Liquidsoap config generation for live recording. The root cause is the failure to properly quote the streamer username in process.run calls. Authenticated station users possessing Streamers and Profil...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

EUVD-2026-87844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844

MONAI versions prior to 1.6.0 are vulnerable to an OS command injection flaw within the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). The root cause is the insecure concatenation of user-controlled values from YAML configuration files (specifically dataset_name_or_id) and CLI/kwar...

CVE-2026-100844: Improper Neutralization of Special Elements used in an OS Command

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

VulnCheck KEV: CVE-2026-100382

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...