CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

Abstraction: Class · CVEs in our corpus: 3,929

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.

Last updated: 16 October 2026 10:19 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-3400` KEV	10.0	10.0	1.0000	2024-04-12
`CVE-2024-29895`	10.0	10.0	0.9849	2024-05-14
`CVE-2025-10035` KEV	10.0	10.0	0.9980	2025-09-18
`CVE-2026-105134` KEV	10.0	10.0	0.0324	2026-10-04
`CVE-2005-2773` KEV	9.9	9.8	0.7459	2005-09-02
`CVE-2007-3010` KEV	9.9	9.8	0.9738	2007-09-18
`CVE-2012-1823` KEV	9.9	9.8	1.0000	2012-05-11
`CVE-2016-10045`	9.9	9.8	0.9774	2016-12-30
`CVE-2016-10108`	9.9	9.8	0.9782	2017-01-03
`CVE-2016-1555` KEV	9.9	9.8	0.9829	2017-04-21
`CVE-2015-2857`	9.9	9.8	0.8418	2017-08-22
`CVE-2019-5420`	9.9	9.8	0.8933	2019-03-27
`CVE-2010-5330` KEV	9.9	9.8	0.3936	2019-06-11
`CVE-2018-19949` KEV	9.9	9.8	0.2863	2020-10-28
`CVE-2020-2509` KEV	9.9	9.8	0.3399	2021-04-17
`CVE-2021-1498` KEV	9.9	9.8	1.0000	2021-05-06
`CVE-2021-45456`	9.9	9.8	0.8889	2022-01-06
`CVE-2022-36553`	9.9	9.8	0.9090	2022-08-29
`CVE-2016-20017` KEV	9.9	9.8	0.6250	2022-10-19
`CVE-2022-43781`	9.9	9.8	0.9804	2022-11-17
`CVE-2023-23333`	9.9	9.8	0.9929	2023-02-06
`CVE-2022-40022`	9.9	9.8	0.9247	2023-02-13
`CVE-2023-1671` KEV	9.9	9.8	1.0000	2023-04-04
`CVE-2023-20887` KEV	9.9	9.8	0.9828	2023-06-07
`CVE-2023-30258`	9.9	9.8	0.9425	2023-06-23