Tag
Pheditor Terminal Argument Injection Leads to Remote Code Execution
4 rules 2 TTPsA vulnerability in Pheditor's terminal feature (versions <= 2.0.6) allows authenticated attackers to achieve arbitrary command execution via argument injection into allowlisted binaries, which can be chained with default credentials for effective unauthenticated remote code execution on the underlying host.
CVE-2026-61459 - Argument Injection in MCP Server Kubernetes Structured Tools Leads to Cluster Compromise
4 TTPs 1 CVEAn argument injection vulnerability, CVE-2026-61459, in MCP Server Kubernetes versions prior to 3.9.0 within structured tools like kubectl_get, kubectl_describe, and kubectl_delete allows attackers to bypass the assertNoDangerousFlags security check by injecting parameters with leading dashes to redirect kubectl commands to an attacker-controlled API server, enabling the exfiltration of the operator's bearer token and leading to full Kubernetes cluster compromise.
CVE-2026-14459: Argument Injection Vulnerability in TUBITAK BILGEM pardus-software
1 TTP 2 CVEs 2 IOCsA critical argument injection vulnerability (CVE-2026-14459) in TUBITAK BILGEM Software Technologies Research Institute's pardus-software versions up to 1.0.4 allows a local, low-privileged attacker to achieve unauthorized command execution, severely impacting confidentiality, integrity, and availability.
Gogs Remote Code Execution via git rebase --exec Argument Injection (GHSA-qf6p-p7ww-cwr9)
1 rule 5 TTPsGogs, a self-hosted Git service, is vulnerable to a Critical (CVSS 9.9) Remote Code Execution (RCE) via `git rebase --exec` argument injection (GHSA-qf6p-p7ww-cwr9) during pull request merge operations, allowing an authenticated attacker to execute arbitrary commands as the Gogs server process user and achieve full server compromise.
Incus Argument Injection Vulnerability Leads to Arbitrary File Write and Command Execution
2 rules 5 TTPs 2 IOCsAn argument injection vulnerability (CVE-2026-48755) exists in Incus due to improper validation of the user-provided backup compression algorithm, allowing an authenticated attacker to inject arbitrary arguments into the command line, leading to an arbitrary file write on the host and subsequent arbitrary command execution.
Gogs Zero-Day Vulnerability Enables Remote Code Execution
2 rules 1 TTP 5 CVEsAn unpatched argument injection vulnerability in Gogs (versions 0.14.2 and 0.15.0+dev) allows authenticated attackers to achieve remote code execution (RCE) on vulnerable instances, potentially leading to complete server compromise.
exiftool-vendored Argument Injection Vulnerability
2 rules 1 TTPexiftool-vendored is vulnerable to argument injection (CVE-2026-43893) via newline characters in tag names, potentially allowing attackers to read or write files accessible to the ExifTool process by injecting arguments through caller-supplied strings.
Salesforce Marketing Cloud Engagement Argument Injection Vulnerability (CVE-2026-2298)
2 rules 1 TTP 1 IOCCVE-2026-2298 is an argument injection vulnerability in Salesforce Marketing Cloud Engagement that allows Web Services Protocol Manipulation in versions prior to January 30th, 2026.
Gotenberg ExifTool Argument Injection via Metadata Values
2 rules 1 TTPGotenberg version 8.30.1 and earlier is vulnerable to argument injection, where an unauthenticated attacker can inject arbitrary ExifTool pseudo-tags via newline characters in metadata values, leading to arbitrary file manipulation within the container filesystem.