Command injection

What it means

Command injection happens when your application passes user-controlled text to the operating system's shell and the shell treats part of it as a command. A feature meant to ping a host or convert a file ends up running whatever an outsider typed after it.

It is the same family as SQL injection, aimed at the server instead of the database. Characters such as semicolons, pipes and backticks let the attacker end the intended command and start another, with the same rights as your application.

Why it matters

The result is often remote code execution: reading files, stealing secrets from environment variables, installing software, moving to other systems and staying there quietly. A flaw in one small feature can become control of the whole server. A flaw in one small feature can become control of the server and everything it can reach.

For a business, that means customer data, cloud credentials and a long, expensive investigation. Because the command runs inside your own infrastructure, it also bypasses controls such as firewalls that watch only traffic coming in from outside. The first you hear of it may be a cloud provider's abuse notice.

How it shows up

It appears wherever code builds a command string: image and PDF conversion, network diagnostic tools, archive handling, backup scripts, calls to command-line utilities in the language's shell function. Filenames, URLs, form fields and even the text inside an uploaded file are the usual carriers, so the risky code is often far from the page that took the input.

The strongest fix is not to use the shell at all: call a library, or run the program with arguments passed as a list rather than joined into a string. If you must, accept only values from a strict allowlist. Blacklists of bad characters fail, because there are too many ways to write the same command.