Command injection
OS command injection (CWE-78). Untrusted input becomes part of an operating-system command and lets an attacker run commands. Pass arguments as a list without a shell, and validate any value that the program could read as an option.
- Also called
- OS command injection · shell injection
- Fix it in your stack
- OS command and argument injection fix cards (6 stacks) · CWE-78 page
- Defined in
- MITRE CWE-78
- Identifiers
- CWE-78: OS command injection
Covered in
Run external programs without command or argument injection
Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
ASVS 5.0 verification records: requirement, test and evidence another engineer can repeat
Scope edition-qualified requirements, connect them to implementation and tests, and separate a passing check from an unsupported assurance claim.
Apply CISA Secure by Design: principles, pledge goals and evidence
What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.
Keep untrusted CI work outside the release boundary
Review workflow authority, persistent state and artifact handoffs before contributor-controlled code reaches privileged jobs.
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
All 7 pages that cover Command injection in the library
Practice: XSS lab: Render a model’s answer as text instead of active markup · Release evidence lab: Keep stale test evidence out of a release decision · Actions injection lab: Flag GitHub Actions expression injection · SQL injection lab: Separate SQL structure from data with sqlite3