Command Injection

Passing unsanitized input into a shell call, executing attacker-chosen operating-system commands.

Specifications & Metrics

cwe

CWE-78

impact

Critical

Core Principles & Analysis

• One semicolon or pipe in a filename can hand over a full shell.
• Distinct from code injection: it abuses system calls, not application code paths.
• Defence is structured APIs and argument arrays — never string-built commands.