CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection
HackerOnecurl2026-10-14
Web
Not rated
BUG BOUNTY WRITEUPS
Command injection writeups
User input reaching a shell command. Common in network tools, file converters, CI systems and appliances.
67 reports and writeups from 2024 to 2026. 39 carry a severity from the disclosing platform, 32 of them rated High or Critical. Last updated 2026-10-30.
Latest Command injection reports
Search and filter all writeupsOh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
Researcher blog2026-09-28
Web
Not rated
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Researcher blog2026-09-24
Web
Not rated
Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip Flags
HackerOneAWS VDP2026-09-16
Web, Cloud
High
Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command execution
HackerOneWeblate2026-09-15
Web, Source Code
High
56: IBM i CL wrapper `parse_command_line()` never enters quote mode
HackerOnecurl2026-09-14
Web
Not rated
OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)
HackerOneAWS VDP2026-07-06
Web, Cloud, Source Code
High
Node --run POSIX positional argument escaping allows shell command injection
HackerOneNode.js2026-06-23
Web
High
Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`
HackerOneAWS VDP2026-06-11
Web, Cloud
High
More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)
Researcher blog2026-06-10
Web
Not rated
Argument Injection via curl Short-Flag Grouping
HackerOnecurl2026-04-13
Web
Critical
SMTP Command Injection via CRLF in libcurl MAIL_FROM / MAIL_RCPT (lib/smtp.c)
HackerOnecurl2026-04-06
Web
Not rated
SSTI leads to Command injection
HackerOnecurl2026-03-04
Web
Not rated
wcurl Argument Injection via Unquoted Variable
HackerOnecurl2026-01-26
Web
Medium
Command Injection on Amazon Q Developer CLI via malicious .amazonq/mcp.json leads to arbitrary code execution
HackerOneAWS VDP2026-01-16
Web, Cloud
Not rated
Gopher Protocol Command Injection (SSRF Smuggling)
HackerOnecurl2026-01-14
Web
High
GlobalProtect - OS Command Injection #█████████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command Injection
HackerOnecurl2025-12-25
Web
High
Command Injection - CRITICISM
HackerOnecurl2025-11-11
Web
Not rated
SMTP CRLF Command Injection in CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT
HackerOnecurl2025-11-10
Web
Medium
SMTP Command Injection Vulnerability in libcurl 8.16.0 via RFC 3461 Suffix
HackerOnecurl2025-10-17
Web
Not rated
SMTP Command Injection Vulnerabilities in curl
HackerOnecurl2025-09-26
Web
Not rated
Unsafe Global IFS Modification in OS400 Shell Script Enables Command Injection and Parsing Flaws (CWE-78/CWE-20)
HackerOnecurl2025-08-12
Web
High
OS Command Injection (subprocess Module Usage)
HackerOnecurl2025-07-07
Web
Low
OS Command Injection in scripts/firefox-db2pem.sh via untrusted certificate nicknames
HackerOnecurl2025-06-28
Web
High
Middleware Authentication Bypass on IBM Portal
HackerOneIBM2025-05-02
Web
Critical
CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com]
HackerOneMTN Group2025-02-22
Web
High
Cisco IOS XE instance at ████ vulnerable to CVE-██████
HackerOneMTN Group2025-02-19
iOS
Critical
Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10
HackerOneTrellix2025-01-12
Web
Critical
Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/
HackerOneU.S. Dept Of Defense2024-12-18
Web, Cloud
Critical
CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAG
HackerOneInternet Bug Bounty2024-12-07
Web
Low
CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/
HackerOneU.S. Dept Of Defense2024-10-25
Web
Critical
Vulnerabilities in Open Source C2 Frameworks
Researcher blogBishop Fox (Sliver), Havoc, Ninja C22024-09-18
Web
Not rated
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-console
HackerOneGitHub2024-09-17
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-check
HackerOneGitHub2024-09-17
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectd
HackerOneGitHub2024-09-17
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection
HackerOneGitHub2024-09-13
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ng
HackerOneGitHub2024-09-13
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forward
HackerOneGitHub2024-09-13
Web
High
[forum.acronis.com] JNDI Code Injection due an outdated log4j component
HackerOneAcronis2024-08-28
Web
Critical
Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution
HackerOne8x82024-08-26
Web
Medium
Remote code injection in Log4j on https://mymtn.mtncongo.net - CVE-2021-44228
HackerOneMTN Group2024-08-24
Web
Critical
Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228
HackerOneMTN Group2024-08-24
Web
Critical
Git-Syncing into Trouble: Exploring Command Injection Flaws in Kubernetes
Researcher blogKubernetes2024-08-09
Web, Cloud
Not rated
WG call injection in /economy/contextcommand
HackerOneValve2024-07-30
Web
Critical
Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large
HackerOneValve2024-07-30
Web
Critical
RCE on partner.steampowered.com
HackerOneValve2024-07-30
Web
Critical
Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier
HackerOneValve2024-07-30
Web
Critical
Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL
HackerOneValve2024-07-30
Web
Critical
HTML Injection into https://www.██████.mil
HackerOneU.S. Dept Of Defense2024-07-19
Web
Low
Hacking a Secure Industrial Remote Access Gateway
Researcher blogHMS (Ewon Cosy+)2024-07-12
Web
Not rated
SSD Advisory – SonicWall SMA100 Stored XSS To RCE
Researcher blogSonicWall2024-07-12
Web
Not rated
Bypass incomplete fix of CVE-2024-27980
HackerOneNode.js2024-07-09
Web
High
Getting Unauthenticated Remote Code Execution On The Logsign Unified Secops Platform
Researcher blogLogsign2024-07-01
Web, Source Code
Not rated
Exploiting Steam: Usual and Unusual Ways in the CEF Framework
Researcher blogValve (Steam), Google (Chromium)2024-06-27
Web
Not rated
Beyond the @ Symbol: Exploiting the Flexibility of Email Addresses For Offensive Purposes
Researcher blogMailCleaner2024-06-07
Web
Not rated
Wikimedia/svgtranslate 2.0.1 Remote Code Execution
Researcher blogWikimedia (SVGTranslate)2024-05-23
Web, Source Code
Not rated
20 Security Issues Found in Xiaomi Devices
Researcher blogXiaomi2024-05-02
Android, Source Code, Binary
Not rated
CVE-2024-2448: Authenticated Command Injection In Progress Kemp LoadMaster
Researcher blogProgress (Kemp LoadMaster)2024-04-16
Web, Source Code
Not rated
BatBadBut: You can't securely execute commands on Windows
Researcher blogPHP, Node.js, Rust2024-04-09
Windows
Not rated
CVE-2024-1212: Unauthenticated Command Injection In Progress Kemp LoadMaster
Researcher blogProgress (Kemp LoadMaster)2024-03-19
Binary
Not rated
OpenNMS Vulnerabilities: Securing Code against Attackers’ Unexpected Ways
Researcher blogOpenNMS2024-02-29
Web, Source Code
Not rated
Command Injection using malicious hostname in expanded proxycommand
HackerOneInternet Bug Bounty2024-02-28$540 bounty
Web
Low
Exploiting embedded mitel phones for unauthenticated remote code execution
Researcher blogMitel2024-02-25
Binary
Not rated
A christmas tale: pwning GTB Central Console (CVE-2024-22107 & CVE-2024-22108)
Researcher blogGTB Technologies2024-01-23
Web, Source Code
Not rated
High Signal Detection and Exploitation of Ivanti's Pulse Connect Secure Auth Bypass & RCE (CVE-2023-46805 & CVE-2024-21887)
Researcher blogIvanti2024-01-19
Web, Source Code
Not rated
Nokia vBMC — BMC Log Scanner Remote Code Execution
MediumNokia2024-01-18
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.