Skip to content
Insights · weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command

Sources read 2026-10-29. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days

What it is

From MITRE's CWE catalogue

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

MITRE classes it as a base-level weakness and rates the likelihood of exploit as high.

What it lets an attacker do

From MITRE's CWE catalogue

  • Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart, Read Files or Directories, Modify Files or Directories, Read Application Data, Modify Application Data, Hide Activities (affects: confidentiality, integrity, availability, non-repudiation)

On CISA's exploited list

From CISA's exploited list

6 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-78, against 6 of 69 in the 90 days before. Over the whole catalogue 113 entries name it. The counts are small, so read them as a rough order, not a rate.

CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.

How MITRE says to find it

From MITRE's CWE catalogue

  • Automated Static Analysis
  • Automated Dynamic Analysis
  • Manual Static Analysis
  • Automated Static Analysis - Binary or Bytecode
  • Dynamic Analysis with Automated Results Interpretation

What MITRE suggests

From MITRE's CWE catalogue

These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.

  • Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
  • Architecture and Design: Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
  • Architecture and Design: For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
  • Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602.

Attack patterns MITRE links to it

From MITRE's CWE catalogue

Our notes that name it

From our own notes

Start with one piece of work.

Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.

Talk to us