CVE-2018-1000802
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C
CVSS
9.8
Critical
EPSS
20.1%
p97
KEV
—
Exploit Today
29
0-100
Published: Sep 18, 2018 · Last modified: Oct 8, 2026 · CWE-77
20.1%EPSS · 30 days20.1%
2026-09-252026-10-23
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- bugs.python.orghttps://bugs.python.org/issue34540
- github.comhttps://github.com/python/cpython/pull/8985
- github.comhttps://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
- mega.nzhttps://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230309-0002/
- usn.ubuntu.comhttps://usn.ubuntu.com/3817-1/
- usn.ubuntu.comhttps://usn.ubuntu.com/3817-2/
- www.debian.orghttps://www.debian.org/security/2018/dsa-4306
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- bugs.python.orghttps://bugs.python.org/issue34540
- github.comhttps://github.com/python/cpython/pull/8985
- github.comhttps://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
- mega.nzhttps://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230309-0002/
- usn.ubuntu.comhttps://usn.ubuntu.com/3817-1/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1050149.1 CRI51.3%
——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.5hCVE-2026-957156.8 MED4.9%
——1An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.13hCVE-2026-957097.2 HIG29.4%
——9Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.5hCVE-2026-957087.2 HIG29.4%
——9Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.5hCVE-2026-957067.2 HIG26.5%
——8Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.5hCVE-2026-957057.2 HIG26.5%
——8Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.5h