CVE-2026-72877: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72580: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

PT-2026-69464

Name of the Vulnerable Software and Affected Versions duhow/xiaoai-patch versions prior to commit fb07049 Description An OS command injection flaw allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers. The issue occurs because the /mute and /unmute endpoints in...

CorgetGpsDget 2_3.2 - OS Command Injection

Exploit Title: CorgetGpsDget 23.2 - OS Command Injection Date: 2026-07-05 Exploit Author: Bytetobreach Fofa server: "PTTServer" Vendor Homepage: http://corget.com Version: GpsDget 23.2, build 2020-09-01 dget.version; product line Gps2.0 Tested on Ubuntu. Binary reversed on Ghidra Debian. Sink is ...

CVE-2026-72874: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with...

PT-2026-69854

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description In installations using SQLite, the navigation menu endpoint improperly handles array-typed user input. This flaw bypasses input sanitization, allowing the input to break out of an internal quoted strin...

CVE-2026-72868: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...

CVE-2026-72733: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-19379: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

CVE-2026-72870: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the buildRemoteDocker function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project...

PT-2026-69474

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3 Description An OS command injection flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries. This occurs when a crafted GET request is sent to the '/crontab' endpoint...

EUVD-2026-44768

jsii-diff: Command Injection via npm: package argument...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the checkunsafeoptions process. An attacker can execute arbitrary OS commands by supplying specially crafted keyword arguments that...

EUVD-2026-54210

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-48098: Improper Neutralization of Special Elements used in an OS Command

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

CVE-2026-19243: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-48122: Improper Neutralization of Special Elements used in an OS Command

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

PT-2026-69125

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description An OS command injection flaw exists in the Shell Allowlist Handler component within the nanobot/agent/tools/shell.py file. The issue resides in the ExecTool. guard command and ExecTool. spawn...

CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...