OS Command Injection

Everything Patch Observer has reported about OS Command Injection: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Managed Sites Exposed to RCE via SPIP odt2spip Plugin Until 4.4.0 Patch Applied

VulnCheck disclosed an authenticated command injection in the SPIP odt2spip plugin, allowing low-privileged authors to execute code on web servers through crafted filenames.

Oct 16, 2026

Vulnerabilities

Organisations at Risk: GPT-SoVITS UVR5 Flaw Enables Unauthenticated System Command Execution

A critical flaw in GPT-SoVITS allows attackers to run system commands via the UVR5 web interface without authentication, affecting versions up to 20250606v2pro.

Oct 13, 2026