Command injection is a vulnerability in which an attacker embeds shell metacharacters (such as ;, &&, |, $()) in input data, causing the string to be interpreted by the shell parser as additional commands to execute.