🎯 OS Command Injection

The items that name it 9

• Hitachi Energy CoreTec Product
  advisory2026-10-28

  Vulnerability class affecting CoreTec products; exploitation could affect confidentiality, integrity and availability

• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  article2026-10-09

  Injecting OS commands via the manipulated functions, used alongside the authentication bypass in CVE-2026-105133

• Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
  article2026-09-30

  Used in CVE-2026-1731 against BeyondTrust PRA/Remote Support for unauthenticated initial access.

• The Most Common Security Vulnerabilities in AI-Generated Code | Blog | Endor Labs
  article2026-09-11It is written here as OS command injection (CWE-78).

  Recurring injection flaw found in AI-generated code due to missing input sanitization

• When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms | Blog | Endor Labs
  article2026-07-31It is written here as OS command injection (CWE-78).

  Unsanitized string interpolation into shell-evaluated execution in Claude Code CLI, exploited via TERMINAL env var, editor-path double-quote bypass, and auth-helper shell=true invocation.

• Strix
  repo2026-07-15

  Injection attack tested by Strix

• AI Security Briefing
  advisory2026-06-27

  Product constructs all or part of an OS command using externally-influenced input from an upstream component, but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command

• CVE-2026-19978: A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292
  advisory

  Manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value passed to the child_process.exec function in build/index.js allows OS command injection. Associated weaknesses: CWE-77 (Command Injection), CWE-78 (OS Command Injection). Attack is local.

• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisory