CWE-88
AllowedImproper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Abstraction: Base · Status: Draft
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
550 vulnerabilities reference this CWE, most recent first.
GHSA-Q495-4RMW-2Q38
Vulnerability from github – Published: 2022-04-29 02:57 – Updated: 2022-04-29 02:57Argument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier allows remote attackers to (1) execute arbitrary code via the ProxyCommand option or (2) conduct port forwarding via the -R option.
{
"affected": [],
"aliases": [
"CVE-2004-0489"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-07-07T04:00:00Z",
"severity": "HIGH"
},
"details": "Argument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier allows remote attackers to (1) execute arbitrary code via the ProxyCommand option or (2) conduct port forwarding via the -R option.",
"id": "GHSA-q495-4rmw-2q38",
"modified": "2022-04-29T02:57:49Z",
"published": "2022-04-29T02:57:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0489"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16242"
},
{
"type": "WEB",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021871.html"
},
{
"type": "WEB",
"url": "http://www.insecure.ws/article.php?story=200405222251133"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q4P8-8J9M-8HXJ
Vulnerability from github – Published: 2026-05-08 18:43 – Updated: 2026-05-08 18:43Impact
A code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.
A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network.
Patches
Fixed in version >= 3.7.9
- https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333
Workarounds
Until a patch is available, it is strongly recommended to:
- Refrain from using the open with system editor or "Edit with custom editor" feature when connected to untrusted or unfamiliar SSH servers.
- Consider using the built-in editor for viewing files, as this path may not be vulnerable to the same injection.
- If the feature must be used, ensure connections are exclusively established with trusted servers and perform rigorous filename validation before editing.
Resources
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.7.8"
},
"package": {
"ecosystem": "npm",
"name": "electerm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43943"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T18:43:52Z",
"nvd_published_at": "2026-05-08T04:16:23Z",
"severity": "HIGH"
},
"details": "### Impact\n\nA code execution (RCE) vulnerability exists in electerm\u0027s SFTP open with system editor or \"Edit with custom editor\" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.\n\nA malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user\u0027s privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network.\n\n\u003cimg width=\"1792\" height=\"817\" alt=\"1\" src=\"https://github.com/user-attachments/assets/ddf78890-e95d-4fe7-981e-f86887677e8b\" /\u003e\n\u003cimg width=\"1648\" height=\"941\" alt=\"2\" src=\"https://github.com/user-attachments/assets/cca2295b-2053-4d99-a464-be51eac2f5be\" /\u003e\n\n### Patches\n\nFixed in version \u003e= 3.7.9\n\n- https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333\n\n### Workarounds\n\nUntil a patch is available, it is strongly recommended to: \n- Refrain from using the open with system editor or \"Edit with custom editor\" feature when connected to untrusted or unfamiliar SSH servers. \n- Consider using the built-in editor for viewing files, as this path may not be vulnerable to the same injection. \n- If the feature must be used, ensure connections are exclusively established with trusted servers and perform rigorous filename validation before editing.\n\n### Resources\n\n- [electerm GitHub Repository](https://github.com/electerm/electerm)",
"id": "GHSA-q4p8-8j9m-8hxj",
"modified": "2026-05-08T18:43:52Z",
"published": "2026-05-08T18:43:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43943"
},
{
"type": "WEB",
"url": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333"
},
{
"type": "PACKAGE",
"url": "https://github.com/electerm/electerm"
},
{
"type": "WEB",
"url": "https://github.com/electerm/electerm/releases/tag/v3.7.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor"
}
GHSA-Q52P-WRC3-9P77
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 test result to execute shell commands with the permissions of the web server.
{
"affected": [],
"aliases": [
"CVE-2021-35062"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-30T20:15:00Z",
"severity": "HIGH"
},
"details": "A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 test result to execute shell commands with the permissions of the web server.",
"id": "GHSA-q52p-wrc3-9p77",
"modified": "2022-05-24T19:12:26Z",
"published": "2022-05-24T19:12:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35062"
},
{
"type": "WEB",
"url": "https://github.com/sthierolf/security/blob/main/CVE-2021-35062.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q5WJ-V48M-CH2M
Vulnerability from github – Published: 2023-04-28 21:30 – Updated: 2024-04-04 03:44An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.
{
"affected": [],
"aliases": [
"CVE-2023-26782"
],
"database_specific": {
"cwe_ids": [
"CWE-88",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-28T20:15:13Z",
"severity": "MODERATE"
},
"details": "An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface -\u003eSystem Configuration-\u003eCache Configuration-\u003eCache security characters.",
"id": "GHSA-q5wj-v48m-ch2m",
"modified": "2024-04-04T03:44:08Z",
"published": "2023-04-28T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26782"
},
{
"type": "WEB",
"url": "https://github.com/chshcms/mccms/issues/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q64H-39HV-4CF7
Vulnerability from github – Published: 2024-04-17 21:30 – Updated: 2024-04-18 13:45When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.
An attacker may format a Git URL in order to inject additional Git arguments to the Git call.
Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/go-getter"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.9"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-3817"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-18T13:45:52Z",
"nvd_published_at": "2024-04-17T20:15:08Z",
"severity": "CRITICAL"
},
"details": "When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository\u2019s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.\n\nAn attacker may format a Git URL in order to inject additional Git arguments to the Git call.\n\nConsumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later. ",
"id": "GHSA-q64h-39hv-4cf7",
"modified": "2024-04-18T13:45:52Z",
"published": "2024-04-17T21:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3817"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/go-getter/commit/268c11cae8cf0d9374783e06572679796abe9ce9"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/go-getter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches"
}
GHSA-Q7QQ-9GX2-GGXV
Vulnerability from github – Published: 2022-12-02 22:26 – Updated: 2022-12-02 22:26phpxmlrpc vulnerable to argument injection via local file access in Client:send via manipulation of $protocol argument.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpxmlrpc/phpxmlrpc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-02T22:26:45Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "phpxmlrpc vulnerable to argument injection via local file access in `Client:send` via manipulation of `$protocol` argument.",
"id": "GHSA-q7qq-9gx2-ggxv",
"modified": "2022-12-02T22:26:45Z",
"published": "2022-12-02T22:26:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gggeek/phpxmlrpc/issues/81"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpxmlrpc/phpxmlrpc/2022-11-28-1.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/gggeek/phpxmlrpc"
},
{
"type": "WEB",
"url": "https://github.com/gggeek/phpxmlrpc/releases/tag/4.9.0"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "phpxmlrpc vulnerable to argument injection"
}
GHSA-Q7R4-HC83-HF2Q
Vulnerability from github – Published: 2026-04-30 17:27 – Updated: 2026-05-08 19:26Vulnerability Details
CWE: CWE-20 - Improper Input Validation
The metadata value sanitization introduced in v8.30.1 (commit 405f106) only validates metadata KEYS via safeKeyPattern regex. Metadata VALUES are passed unsanitized to go-exiftool SetString(), which writes them as fmt.Fprintln(e.stdin, "-"+k+"="+str). A newline (\n) in a value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, -HardLink. Docker-verified: HTTP 404 returned (file moved), /tmp/inject_proof created in container. This is a bypass of the incomplete fix in v8.30.1.
Summary
The metadata write endpoint in v8.30.1 validates metadata keys for control characters (commit 405f106) but leaves metadata values unsanitized. go-exiftool's WriteMetadata sends each key/value pair to ExifTool's stdin as:
fmt.Fprintln(e.stdin, "-"+k+"="+str)
A \n character in str splits this into two separate stdin lines, injecting an arbitrary ExifTool pseudo-tag argument. The attacker controls what comes after the newline, enabling injection of -FileName, -Directory, -SymLink, -HardLink, and other dangerous pseudo-tags — the exact tags the key blocklist was designed to prevent.
Root Cause
pkg/modules/exiftool/exiftool.go — WriteMetadata() function:
// KEY validation added in v8.30.1 (commit 405f106)
for key := range metadata {
if !safeKeyPattern.MatchString(key) { // ← only keys checked
return fmt.Errorf(...)
}
}
// VALUE passed through unsanitized:
case string:
fileMetadata[0].SetString(key, val) // ← val may contain \n
go-exiftool (barasher/go-exiftool) then writes:
fmt.Fprintln(e.stdin, "-"+k+"="+str)
// If str = "test\n-FileName=/tmp/inject_proof"
// ExifTool receives two lines:
// -Title=test
// -FileName=/tmp/inject_proof
Steps to Reproduce
1. Start Gotenberg:
docker run --name gotenberg-test -p 3001:3000 gotenberg/gotenberg:8
2. Create a test PDF:
curl -s -F 'files=@/dev/stdin;filename=index.html;type=text/html' \
-o test.pdf http://localhost:3001/forms/chromium/convert/html \
<<< '<html><body>test</body></html>'
3. Inject -FileName via value newline:
curl -s -w "\nHTTP %{http_code}" \
-F 'files=@test.pdf;type=application/pdf' \
-F 'metadata={"Title":"test\n-FileName=/tmp/inject_proof"}' \
http://localhost:3001/forms/pdfengines/metadata/write
# Returns HTTP 404 (file moved away from temp path)
4. Verify injection inside container:
docker exec gotenberg-test ls -la /tmp/inject_proof
# -rw-r--r-- 1 root root ... /tmp/inject_proof (PDF moved here)
5. Symlink injection:
curl -s -w "\nHTTP %{http_code}" \
-F 'files=@test.pdf;type=application/pdf' \
-F 'metadata={"Title":"test\n-SymLink=/tmp/sym_inject"}' \
http://localhost:3001/forms/pdfengines/metadata/write
docker exec gotenberg-test ls -la /tmp/sym_inject
# lrwxrwxrwx ... /tmp/sym_inject -> /tmp/.../source.pdf
Impact
An unauthenticated attacker can:
- Rename/move any PDF being processed to an arbitrary path in the container filesystem (running as root by default)
- Overwrite arbitrary files — e.g.,
-Directory=/etc/ -FileName=passwdinjects two lines, moving the PDF to/etc/passwd, corrupting the system user database - Create symlinks at arbitrary paths via
-SymLink=, enabling subsequent read/write primitives - Create hard links via
-HardLink=, persisting data beyond temp directory cleanup
This is a complete bypass of the key-sanitization fix introduced in v8.30.1 (commit 405f106). The fix validated the wrong side of the = sign.
Proposed Fix
Add value sanitization parallel to the existing key check in WriteMetadata:
for key, value := range metadata {
if !safeKeyPattern.MatchString(key) {
return fmt.Errorf("write PDF metadata with ExifTool: invalid metadata key %q", key)
}
if str, ok := value.(string); ok {
if strings.ContainsAny(str, "\n\r\x00") {
return fmt.Errorf("write PDF metadata with ExifTool: invalid value for key %q (contains control character)", key)
}
}
}
Or, apply the same safeKeyPattern logic to string values, or percent-encode newlines before passing to go-exiftool.
Vulnerable Code
// See description for details
Steps to Reproduce
- Set up the application using the default configuration
- See the vulnerability details above
Impact
This vulnerability may allow an attacker to compromise the application.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.30.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/gotenberg/gotenberg/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.31.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40281"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-30T17:27:10Z",
"nvd_published_at": "2026-05-06T21:16:01Z",
"severity": "CRITICAL"
},
"details": "## Vulnerability Details\n\n**CWE**: CWE-20 - Improper Input Validation\n\nThe metadata value sanitization introduced in v8.30.1 (commit 405f106) only validates metadata KEYS via safeKeyPattern regex. Metadata VALUES are passed unsanitized to go-exiftool SetString(), which writes them as fmt.Fprintln(e.stdin, \"-\"+k+\"=\"+str). A newline (\\n) in a value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, -HardLink. Docker-verified: HTTP 404 returned (file moved), /tmp/inject_proof created in container. This is a bypass of the incomplete fix in v8.30.1.\n\n## Summary\n\nThe metadata write endpoint in v8.30.1 validates metadata **keys** for control characters (commit 405f106) but leaves metadata **values** unsanitized. go-exiftool\u0027s `WriteMetadata` sends each key/value pair to ExifTool\u0027s stdin as:\n\n```\nfmt.Fprintln(e.stdin, \"-\"+k+\"=\"+str)\n```\n\nA `\\n` character in `str` splits this into two separate stdin lines, injecting an arbitrary ExifTool pseudo-tag argument. The attacker controls what comes after the newline, enabling injection of `-FileName`, `-Directory`, `-SymLink`, `-HardLink`, and other dangerous pseudo-tags \u2014 the exact tags the key blocklist was designed to prevent.\n\n## Root Cause\n\n`pkg/modules/exiftool/exiftool.go` \u2014 `WriteMetadata()` function:\n\n```go\n// KEY validation added in v8.30.1 (commit 405f106)\nfor key := range metadata {\n if !safeKeyPattern.MatchString(key) { // \u2190 only keys checked\n return fmt.Errorf(...)\n }\n}\n\n// VALUE passed through unsanitized:\ncase string:\n fileMetadata[0].SetString(key, val) // \u2190 val may contain \\n\n```\n\ngo-exiftool (`barasher/go-exiftool`) then writes:\n\n```go\nfmt.Fprintln(e.stdin, \"-\"+k+\"=\"+str)\n// If str = \"test\\n-FileName=/tmp/inject_proof\"\n// ExifTool receives two lines:\n// -Title=test\n// -FileName=/tmp/inject_proof\n```\n\n## Steps to Reproduce\n\n```\n1. Start Gotenberg:\n docker run --name gotenberg-test -p 3001:3000 gotenberg/gotenberg:8\n\n2. Create a test PDF:\n curl -s -F \u0027files=@/dev/stdin;filename=index.html;type=text/html\u0027 \\\n -o test.pdf http://localhost:3001/forms/chromium/convert/html \\\n \u003c\u003c\u003c \u0027\u003chtml\u003e\u003cbody\u003etest\u003c/body\u003e\u003c/html\u003e\u0027\n\n3. Inject -FileName via value newline:\n curl -s -w \"\\nHTTP %{http_code}\" \\\n -F \u0027files=@test.pdf;type=application/pdf\u0027 \\\n -F \u0027metadata={\"Title\":\"test\\n-FileName=/tmp/inject_proof\"}\u0027 \\\n http://localhost:3001/forms/pdfengines/metadata/write\n # Returns HTTP 404 (file moved away from temp path)\n\n4. Verify injection inside container:\n docker exec gotenberg-test ls -la /tmp/inject_proof\n # -rw-r--r-- 1 root root ... /tmp/inject_proof (PDF moved here)\n\n5. Symlink injection:\n curl -s -w \"\\nHTTP %{http_code}\" \\\n -F \u0027files=@test.pdf;type=application/pdf\u0027 \\\n -F \u0027metadata={\"Title\":\"test\\n-SymLink=/tmp/sym_inject\"}\u0027 \\\n http://localhost:3001/forms/pdfengines/metadata/write\n docker exec gotenberg-test ls -la /tmp/sym_inject\n # lrwxrwxrwx ... /tmp/sym_inject -\u003e /tmp/.../source.pdf\n```\n\n## Impact\n\nAn unauthenticated attacker can:\n\n1. **Rename/move** any PDF being processed to an arbitrary path in the container filesystem (running as root by default)\n2. **Overwrite** arbitrary files \u2014 e.g., `-Directory=/etc/ -FileName=passwd` injects two lines, moving the PDF to `/etc/passwd`, corrupting the system user database\n3. **Create symlinks** at arbitrary paths via `-SymLink=`, enabling subsequent read/write primitives\n4. **Create hard links** via `-HardLink=`, persisting data beyond temp directory cleanup\n\nThis is a complete bypass of the key-sanitization fix introduced in v8.30.1 (commit 405f106). The fix validated the wrong side of the `=` sign.\n\n## Proposed Fix\n\nAdd value sanitization parallel to the existing key check in `WriteMetadata`:\n\n```go\nfor key, value := range metadata {\n if !safeKeyPattern.MatchString(key) {\n return fmt.Errorf(\"write PDF metadata with ExifTool: invalid metadata key %q\", key)\n }\n if str, ok := value.(string); ok {\n if strings.ContainsAny(str, \"\\n\\r\\x00\") {\n return fmt.Errorf(\"write PDF metadata with ExifTool: invalid value for key %q (contains control character)\", key)\n }\n }\n}\n```\n\nOr, apply the same `safeKeyPattern` logic to string values, or percent-encode newlines before passing to go-exiftool.\n\n### Vulnerable Code\n\n```go\n// See description for details\n```\n\n## Steps to Reproduce\n\n1. Set up the application using the default configuration\n2. See the vulnerability details above\n\n\n## Impact\n\nThis vulnerability may allow an attacker to compromise the application.",
"id": "GHSA-q7r4-hc83-hf2q",
"modified": "2026-05-08T19:26:57Z",
"published": "2026-04-30T17:27:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40281"
},
{
"type": "WEB",
"url": "https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318"
},
{
"type": "PACKAGE",
"url": "https://github.com/gotenberg/gotenberg"
},
{
"type": "WEB",
"url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)"
}
GHSA-Q9JX-PP2V-V8XH
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2025-10-22 00:31rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
{
"affected": [],
"aliases": [
"CVE-2020-12641"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-04T15:15:00Z",
"severity": "HIGH"
},
"details": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.",
"id": "GHSA-q9jx-pp2v-v8xh",
"modified": "2025-10-22T00:31:54Z",
"published": "2022-05-24T17:17:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12641"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3"
},
{
"type": "WEB",
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"type": "WEB",
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QC6X-G3H2-596Q
Vulnerability from github – Published: 2022-05-01 06:55 – Updated: 2022-05-01 06:55Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
{
"affected": [],
"aliases": [
"CVE-2006-2058"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-04-26T20:06:00Z",
"severity": "MODERATE"
},
"details": "Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via \" (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.",
"id": "GHSA-qc6x-g3h2-596q",
"modified": "2022-05-01T06:55:21Z",
"published": "2022-05-01T06:55:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2058"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26118"
},
{
"type": "WEB",
"url": "http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/785"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/432009/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/1538"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QFFW-8WG7-H665
Vulnerability from github – Published: 2022-04-23 00:03 – Updated: 2022-04-29 17:22A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an --upload-pack command-line argument feature of git is also supported for git clone, which would then allow for any operating system command to be spawned by the attacker.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "git-interface"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1440"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-26T13:06:52Z",
"nvd_published_at": "2022-04-22T18:15:00Z",
"severity": "CRITICAL"
},
"details": "A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.",
"id": "GHSA-qffw-8wg7-h665",
"modified": "2022-04-29T17:22:43Z",
"published": "2022-04-23T00:03:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1440"
},
{
"type": "WEB",
"url": "https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d"
},
{
"type": "PACKAGE",
"url": "https://github.com/yarkeev/git-interface"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Command injection in git-interface"
}
Mitigation
Strategy: Parameterization
Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
Mitigation
Strategy: Input Validation
Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation
Directly convert your input type into the expected data type, such as using a conversion function that translates a string into a number. After converting to the expected data type, ensure that the input's values fall within the expected range of allowable values and that multi-field consistencies are maintained.
Mitigation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180, CWE-181). Make sure that your application does not inadvertently decode the same input twice (CWE-174). Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked. Use libraries such as the OWASP ESAPI Canonicalization control.
- Consider performing repeated canonicalization until your input does not change any more. This will avoid double-decoding and similar scenarios, but it might inadvertently modify inputs that are allowed to contain properly-encoded dangerous content.
Mitigation
When exchanging data between components, ensure that both components are using the same character encoding. Ensure that the proper encoding is applied at each interface. Explicitly set the encoding you are using whenever the protocol allows you to do so.
Mitigation
When your application combines data from multiple sources, perform the validation after the sources have been combined. The individual data elements may pass the validation step but violate the intended restrictions after they have been combined.
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
CAPEC-137: Parameter Injection
An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.
CAPEC-174: Flash Parameter Injection
An adversary takes advantage of improper data validation to inject malicious global parameters into a Flash file embedded within an HTML document. Flash files can leverage user-submitted data to configure the Flash document and access the embedding HTML document.
CAPEC-41: Using Meta-characters in E-mail Headers to Inject Malicious Payloads
This type of attack involves an attacker leveraging meta-characters in email headers to inject improper behavior into email programs. Email software has become increasingly sophisticated and feature-rich. In addition, email applications are ubiquitous and connected directly to the Web making them ideal targets to launch and propagate attacks. As the user demand for new functionality in email applications grows, they become more like browsers with complex rendering and plug in routines. As more email functionality is included and abstracted from the user, this creates opportunities for attackers. Virtually all email applications do not list email header information by default, however the email header contains valuable attacker vectors for the attacker to exploit particularly if the behavior of the email client application is known. Meta-characters are hidden from the user, but can contain scripts, enumerations, probes, and other attacks against the user's system.
CAPEC-460: HTTP Parameter Pollution (HPP)
An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
CAPEC-88: OS Command Injection
In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.