CVE-2018-1000802
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C
CVSS
9.8
Crítica
EPSS
20.1%
p97
KEV
—
Exploit Today
29
0-100
Publicado: 18 de set. de 2018 · Última mod.: 8 de out. de 2026 · CWE-77
20.1%EPSS · 30 dias20.1%
2026-10-142026-11-11
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- bugs.python.orghttps://bugs.python.org/issue34540
- github.comhttps://github.com/python/cpython/pull/8985
- github.comhttps://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
- mega.nzhttps://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230309-0002/
- usn.ubuntu.comhttps://usn.ubuntu.com/3817-1/
- usn.ubuntu.comhttps://usn.ubuntu.com/3817-2/
- www.debian.orghttps://www.debian.org/security/2018/dsa-4306
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- bugs.python.orghttps://bugs.python.org/issue34540
- github.comhttps://github.com/python/cpython/pull/8985
- github.comhttps://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
- mega.nzhttps://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230309-0002/
- usn.ubuntu.comhttps://usn.ubuntu.com/3817-1/
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1261677.2 ALT—
———A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.6hCVE-2026-960537.8 ALT54.6%
——16Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.1dCVE-2026-839535.5 MÉD57.9%
——17Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.1dCVE-2026-1233878.0 ALT57.3%
——17Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.1dCVE-2026-1216628.6 ALT45.1%
——14Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.1dCVE-2026-1199898.2 ALT48.7%
——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.1d