Tested fixes for CWE-88 in Express, Flask, Spring Boot, ASP.NET Core, Next.js and net/http: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-88: The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Common consequences MITRE lists
- Confidentiality, Integrity, Availability, Other: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
Many programs have options that run commands, write files or read configuration, so a value such as --upload-pack=<command> turns a safe argument array into code execution.
- Put user-supplied operands after
--, or after--end-of-optionsfor Git commands that use--to separate revisions from paths. - Reject values that start with
-, and validate each value against what it should be: an ID, a URL with an allowed scheme, a file name the server generated. - Never split a command string into an argument array; build the array from separate values.
Guides on this site
Run external programs without command or argument injection
Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Practice
- SQL injection lab: Separate SQL structure from data with sqlite3 · Browser lab
- OS command injection lab: Run git without a shell · Browser lab
- SSTI lab: Render a welcome banner without template injection · Browser lab
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- Parse bounded JSON and XML invoices safely · Local project
- Repair a native parser using sanitizer evidence · Local project
References
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.