Command Injection
A security vulnerability type in which an attacker embeds shell metacharacters in input data, causing a program to execute that data as shell commands. It commonly occurs when user input is directly concatenated into shell command strings without proper sanitization.
Timeline (last 90 days)
Command injection is a vulnerability in which an attacker embeds shell metacharacters (such as ;, &&, |, $()) in input data, causing the string to be interpreted by the shell parser as additional commands to execute.
The correct approach to fixing command injection is to use execFile with a separate argument array, reject non-compliant branch text with a strict regular expression, and set a timeout.
The approach to fixing code should preserve the business objective (such as tool name, execution order, and timeout requirements) while replacing the dangerous mechanism (such as template strings, the shell: true flag, and dependencies that wrap a shell).
All Facts (3)
Command injection is a vulnerability in which an attacker embeds shell metacharacters (such as ;, &&, |, $()) in input data, causing the string to be interpreted by the shell parser as additional commands to execute.
50%UnverifiedThe correct approach to fixing command injection is to use execFile with a separate argument array, reject non-compliant branch text with a strict regular expression, and set a timeout.
50%UnverifiedThe approach to fixing code should preserve the business objective (such as tool name, execution order, and timeout requirements) while replacing the dangerous mechanism (such as template strings, the shell: true flag, and dependencies that wrap a shell).
50%