CODESYS V2 runtime system SP prior to 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
codesys runtime toolkit