CVE-2026-110204: Interpretation Conflict

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine treats $ command; substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted...

CVE-2026-110203: Interpretation Conflict

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...

CVE-2026-110202: Interpretation Conflict

Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...

CVE-2026-104584: Improper Neutralization of Special Elements used in an OS Command

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

CVE-2026-96951: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

CVE-2026-89198: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the...

CVE-2026-89196: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...

CVE-2026-89116: Improper Neutralization of Special Elements used in an OS Command

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-103848: Improper Neutralization of Special Elements used in an OS Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-110233: Improper Neutralization of Special Elements used in an OS Command

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

CVE-2026-110236: Improper Neutralization of Special Elements used in an OS Command

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-55601: Improper Neutralization of Special Elements used in an OS Command

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-110005: Undefined Security Weakness

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

CVE-2026-104585: Improper Neutralization of Special Elements used in a Command

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-86022: Improper Neutralization of Special Elements used in an OS Command

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...

CVE-2026-53563: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-69718: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...

CVE-2026-96893: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing...