Weakness · CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Input reaches an operating-system shell, letting an attacker run any command the service can.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-107861E3 Firmware: Kiloview E3 NDI Encoder OS Command InjectionCritical 9.4
- CVE-2026-109122E3 Firmware: Kiloview E3 NDI Encoder OS Command InjectionCritical 9.4
- CVE-2026-110243E3 Firmware: Kiloview E3 NDI Encoder OS Command InjectionCritical 9.4
- CVE-2026-73570Zimbra Collaboration Suite (ZCS) OS Command Injection VulnerabilityHigh 8.9KEV
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionCritical 9.3KEV
- CVE-2026-105740Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverCritical 9.9
- CVE-2026-106931EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityHigh 8.5KEV
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- AC-3Access EnforcementAccess Control · mitigates 10 techniques
- AC-6Least PrivilegeAccess Control · mitigates 10 techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 10 techniques
- AC-2Account ManagementAccess Control · mitigates 9 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 9 techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 8 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 7 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 7 techniques
- SI-7Software, Firmware, and Information IntegritySystem and Information Integrity · mitigates 7 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 6 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.