system called with a variable or concatenated string can execute attacker-controlled commands.
Avoid the shell; use execve with a fixed argument vector and validated inputs.