# Command injection

User input is passed to a system shell, letting an attacker run their own operating system commands on the server.

How to fix: Upgrade, and pass arguments to programs as a list instead of through a shell.


- [CVE-2026-105134](https://insights.sbomify.com/CVE-2026-105134/): Ahsay AhsayCBS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-16812](https://insights.sbomify.com/CVE-2026-16812/): Arista VeloCloud Orchestrator On-Prem OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-10520](https://insights.sbomify.com/CVE-2026-10520/): Ivanti Sentry OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-34910](https://insights.sbomify.com/CVE-2026-34910/): Ubiquiti UniFi OS Improper Input Validation (critical 10.0, exploited in the wild)
- [CVE-2025-20393](https://insights.sbomify.com/CVE-2025-20393/): Cisco Multiple Products Improper Input Validation (critical 10.0, exploited in the wild)
- [CVE-2024-50603](https://insights.sbomify.com/CVE-2024-50603/): Aviatrix Controllers OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2024-51378](https://insights.sbomify.com/CVE-2024-51378/): CyberPanel Incorrect Default Permissions (critical 10.0, exploited in the wild)
- [CVE-2024-45519](https://insights.sbomify.com/CVE-2024-45519/): Synacor Zimbra Collaboration Suite (ZCS) Command Execution (critical 10.0, exploited in the wild)
- [CVE-2024-3400](https://insights.sbomify.com/CVE-2024-3400/): Palo Alto Networks PAN-OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2024-1212](https://insights.sbomify.com/CVE-2024-1212/): Progress Kemp LoadMaster OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2022-20708](https://insights.sbomify.com/CVE-2022-20708/): Cisco Small Business RV Series Routers Stack-based Buffer Overflow (critical 10.0, exploited in the wild)
- [CVE-2026-1731](https://insights.sbomify.com/CVE-2026-1731/): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection (critical 9.9, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/types/command-injection/