CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

simple-git allows command execution through unblocked Git configuration includes

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

GPT Researcher MCP STDIO configuration allows remote command execution

react-dev-utils openBrowser permits command injection on macOS

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

danger allows local OS command injection through crafted file paths

SurrealDB server-takeover via SurrealQL injection on backup import

Duplicate Advisory: SurrealDB server-takeover via SurrealQL injection on backup import

Apache Ranger has a Command Injection vulnerability

LibreNMS Vulnerable to Remote Code Execution via AboutController

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

degit has a Command Injection issue

Logging operator has Fluentd configuration injection that allows remote code execution

net-imap vulnerable to command Injection via unvalidated Symbol inputs

NietThijmen ShoppingCart: Command injection in the connect function

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

LangBot: Authenticated RCE Via MCP Configuration

laravel-backup-restore has an OS Command Injection during database restore

GoClaw has a Command Injection issue