OS Command Injection

OmniRoute is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of attacker-controlled binary and versionCommand values before executing them with execFileSync, which allows an unauthenticated attacker under certain configurations to supply interpreter...

CVE-2026-90444

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444

CVE-2026-90444 describes a shell metacharacter injection vulnerability in a file-transfer interface within an ICS/OT product (per CISA advisory ICSA-26-254-01). The interface requires valid credentials but does not restrict shell metacharacters in uploaded filenames. An automated process later co...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

SnowCrash

Snow Crash A Linux security project focused on privilege esca...

CVE-2026-89066

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-7863

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

EUVD-2026-76151

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-89066

CVE-2026-89066 is an OS command injection vulnerability in the task synthesis component of projen (versions before 0.103.0 ). Shell metacharacters present in project configuration values and repository file names are interpolated unsanitized into generated task definitions, allowing arbitrary com...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

EUVD-2026-76149

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-7863

CVE-2026-7863 is an OS command injection vulnerability in TUBITAK BILGEM's Pardus Software (versions before 1.0.5 ), caused by improper neutralization of special elements used in an OS command. The vulnerability is reachable via a local attack vector with low complexity , requires no privileges a...