Command Injection
Command injection is a vulnerability where an attacker supplies input that gets executed as an operating-system command by the application, letting them run arbitrary commands on the host. It occurs when untrusted input is passed into a shell or command call without strict validation.
Command injection happens when an application builds an operating-system command from untrusted input and hands it to a shell. Shell metacharacters such as ;, |, &&, $(...), and backticks let an attacker append or substitute their own commands — for example, turning a filename parameter into file.txt; rm -rf /. The injected commands run with the privileges of the application process.
The root cause is invoking a command interpreter that parses the combined string. The strongest defense is to avoid the shell entirely: call the target program directly with an argument array (so arguments are never re-parsed), rather than passing a single command string to a shell. Where a shell is unavoidable, restrict input to a strict allowlist and never rely on blacklisting metacharacters.
Command injection is tracked as CWE-78 and sits in the OWASP Top 10 injection category. It is especially dangerous because a successful attack often yields full remote code execution and control of the server, making it a high-priority finding for any code scanner.