OS command injection (ARCH3102)

Key typescript.security.os-command-injection · Severity error · Category security · CWE CWE-78

Building a command string from user input and running it through a shell lets attackers execute arbitrary commands using characters like ; or |.

Incorrect

import { exec } from "child_process";

app.get("/ping", (req, res) => {
  // host="8.8.8.8; rm -rf /"
  exec(`ping -c 1 ${req.query.host}`, (err, out) => res.send(out));
});

Correct

import { execFile } from "child_process";

app.get("/ping", (req, res) => {
  const host = String(req.query.host);
  if (!/^[a-z0-9.-]+$/i.test(host)) return res.status(400).end();
  execFile("ping", ["-c", "1", host], (err, out) => res.send(out));
});

Fix

Use execFile/spawn instead of a shell, pass arguments as an array, and validate input.