Argument injection
Untrusted input is passed to a program as an argument that the program reads as an option, such as a value beginning --output= or --upload-pack=, even when no shell is involved (CWE-88). Put user values after the -- end-of-options marker (--end-of-options in Git) and reject values that start with a dash.
- Also called
- option injection
- Fix it in your stack
- OS command and argument injection fix cards (6 stacks) · CWE-88 page
- Defined in
- MITRE CWE-88
- Identifiers
- CWE-88: Argument injection
Covered in
Run external programs without command or argument injection
Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities