CVE-2026-16492: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

CVE-2026-16489: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

PT-2026-63273

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16488

The CVE covers QUSETIONS MiniCode-Python 0.1.0 where the subprocess.Popen call in minicode/config.py of the Project File Handler is vulnerable to OS command injection. The issue can be exploited remotely with high attack complexity and no privileges required, though user interaction is indicated ...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.260.0...

CVE-2026-47392 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...

CVE-2026-8985: Improper Neutralization of Special Elements used in an OS Command

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-59846: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-30631: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 2025-09-11 allowing attackers to execute arbitrary code via crafted path to computerwritefile...

CVE-2026-47392: Incomplete List of Disallowed Inputs

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...

CVE-2026-8986: Improper Neutralization of Special Elements used in an OS Command

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-6952: Improper Neutralization of Special Elements used in an OS Command

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

CVE-2026-63766

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

CVE-2026-63766

GPT-SoVITS up to 20250606v2pro is vulnerable to OS command injection in webui.py. The ASR, slice, denoise and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True, allowing attackers to inject shell metacharacters via path parameters t...