Command injection
Named by 33 kept items in this workspace.
24 items name it under techniques and 9 under classification.key entities.
Search every workspace for Command injection. It matches the name as written, so it can find other things that share it.
The items that name it 33
Vulnerability class patched in ASUS router firmware using AI.
Vulnerability class example; behind IAM authentication, correctly classified as P0 since impact (remote code execution) is unchanged despite reduced attacker pool
Used in CVE-2024-45519 (postjournal service) and CVE-2026-73570 (SNMP notification handling) for unauthenticated command execution.
named in OWASP MCP Top 10 taxonomy
Tool arguments are interpolated into shell commands via exec or spawn, enabling arbitrary command execution; demonstrated in bytebot via a path parameter interpolated into a sudo-prefixed exec call to spawn a root reverse shell.
Discussion body content injected directly into a shell command in the GitHub Actions workflow, allowing arbitrary command execution
Exploited in cmsSnmpTrap.sh on SonicWall SMA1000 to achieve root-level RCE
classic bug shown up in real MCP servers
Potential OS command injection via system or popen
one of the three oldest injection classes cited alongside SQL injection and path traversal
Payload coverage
Command injection vulnerability hunting
Example vulnerability whose exploit demonstration risk (e.g. rm -rf /) motivates the canary-based safety contract
High-signal exploit shape consistently found cleanly by model configurations; found across all 25 model repetitions in js-project-tigerteam fixture.
Covered by Semgrep rules and p/command-injection pack
Vulnerability from concatenating unchecked strings into a command string
Vulnerability category where data flow across files must be analyzed; AI-native solution showed at least three times higher true positive rates than traditional SAST
Injection attack category detected by the tool
Vulnerability type found in @next/codemod: previously used execSync with string concatenation for git commands (e.g. execSync(`git clone ${repoUrl} ${cloneDir}`)), allowing shell metacharacter injection via inputs like a malicious package.json devDependency ("next": "$(touch /tmp/testpoc)") triggere
Attacker attempted to inject commands into Product B's task parameters and submitted code via its web execution endpoint to alter configuration and assemble malicious files.
Three consecutive attempts to inject system commands into Product B's task parameters to write malicious files
Performing command injection attacks to execute arbitrary commands as root (CVE-2026-20305/20306, Nexus Dashboard CVEs, Secure Email Gateway CVEs).
Other common vulnerability that can exist and impact code executed in the privileged pull_request_target event
All techniques in this workspace.