Command Injection Prevention: How to Detect and Fix Shell Injection Vulnerabilities
What Is Command Injection and How Does It Work?
Command injection is a vulnerability where an attacker injects shell metacharacters into application input that is concatenated into operating system commands. Functions like exec(), execSync(), spawn(), system(), and popen() pass strings to the shell, and metacharacters such as ;, |, and ` allow arbitrary command execution.
The vulnerability occurs at the boundary between application code and the operating system shell. When a Node.js application runs exec("git clone " + repoUrl), the repoUrl variable is concatenated into a string that passes through /bin/sh. An attacker who sets repoUrl to ; cat /etc/passwd causes the shell to execute both the git clone and the attacker's command.
Template literal interpolation creates the same vulnerability. exec(`convert ${filename} output.png`) is injectable through the filename parameter. Shell metacharacters in the filename — semicolons, pipes, backticks, $() subshells — are interpreted by the shell rather than treated as literal filename characters.
Command injection ranks as one of the most severe web application vulnerabilities because it grants the attacker operating system access. A successful injection on a server running as root gives the attacker full control of the machine, including file system access, network pivoting, and persistence through cron jobs or startup scripts.
How Does Vibe Owl Detect Command Injection Patterns?
Vibe Owl detects command injection patterns through the command-injection-risk heuristic rule at 82% confidence. The detector identifies exec, execSync, spawn, spawnSync, system, and popen calls that use string concatenation with the + operator or template literal ${} interpolation, flagging the exact injection point.
The 82% confidence score maps to high severity (0.80–0.94 range), meaning command injection findings appear prominently in diagnostics and affect the preflight check. The detector fires on every file open, edit, and save event, providing immediate feedback when a developer writes or accepts an injectable pattern.
The detection covers multiple languages. Node.js exec() and execSync() from the child_process module, Python os.system() and subprocess.Popen() with shell strings, Ruby system() and backtick execution, and PHP exec() and shell_exec() all trigger the rule when string concatenation is present.
The diagnostic tooltip explains the specific risk and suggests the safe alternative: use argument arrays instead of string concatenation. Secure coding practices require eliminating string concatenation from all shell command construction, replacing it with parameterized execution.
How Do You Fix Command Injection in Node.js?
Fixing command injection in Node.js requires replacing string-concatenated exec() calls with spawn() or execFile() using argument arrays. The call spawn("ls", [userInput]) passes input as a separate argument without shell interpretation, preventing metacharacter injection. The shell: false option (default for spawn) ensures no shell is invoked.
The vulnerable pattern exec(`grep ${term} file.txt`) becomes spawn("grep", [term, "file.txt"]). Each argument occupies its own position in the argument array, and the operating system passes them directly to the program without shell parsing. Semicolons, pipes, and backticks in term are treated as literal characters, not shell operators.
For cases where a shell is required (piping between commands, glob expansion), input validation with an allowlist provides defense. Validating that user input matches an expected pattern — alphanumeric characters only, specific allowed values, or a regex whitelist — prevents injection even when shell interpretation is enabled.
How Does CLI Install Safety Detect Dangerous Shell Commands?
CLI Install Safety analyzes arbitrary shell commands using a weighted scoring system. Piping curl or wget to sh/bash/zsh adds 4 risk points. Base64 decode piped to shell adds 5 points. Known C2 domains add 6 points. The total score maps to critical (>=6), high (>=4), medium (>=2), or low (<2) risk levels.
The Vibe Owl: Check CLI Install Command Safety command prompts for a command string and returns a detailed risk assessment. Pipe-to-shell patterns like curl https://example.com | bash score 4 (high risk) because they download and execute remote code without inspection. Adding sudo increases the score by 3 because the command runs with root privileges.
The scoring system detects XCSSET malware patterns specifically. Multi-layer base64 decode chains (base64 --decode | base64 --decode) score 5 points. Known command-and-control domains (funchats.ru, timewebnet.in, cdnapple.ru) score 6 points. RAT process names and LaunchDaemon patterns also trigger critical scores.
Safer alternatives are suggested for every flagged command. Instead of curl | bash, the tool recommends downloading the script first, inspecting its contents, then executing it. Instead of npm install from a URL, it recommends verifying the package on the registry. macOS developer security depends on evaluating install commands before execution, especially those suggested by AI tools.
How Does Malware Detection Complement Command Injection Prevention?
Malware detection complements command injection prevention by identifying obfuscated shell execution patterns that bypass simple string matching. The base64-shell-execution detector catches echo [base64] | base64 --decode | sh chains at 96% confidence. XCSSET-specific detectors identify multi-layer encoding, backgrounded subshell execution, and process name indicators.
Base64-encoded command execution is the primary obfuscation technique in macOS malware. The XCSSET malware family uses multi-layer base64 encoding to hide shell commands inside Xcode project files. The encoded payload decodes to a shell command that downloads additional malware from command-and-control servers.
Vibe Owl's malware detection rules cover nine patterns: base64 shell execution, Xcode injected build phases, RAT C2 domains, RAT IOC identifiers, XCSSET multi-layer base64, XCSSET build phase names, XCSSET backgrounded base64, XCSSET process names, and XCSSET osascript temp file execution. Each rule targets a specific attack technique observed in real-world macOS malware campaigns.
How Does Staged Diff Preview Catch Newly Introduced Injection Risks?
Staged diff preview analyzes changes about to be committed by running git diff --cached against all detector rules. Added lines (lines starting with +) are scanned for command injection patterns, eval usage, and other code risks. High or critical findings in the staged diff cause the preflight check to fail.
The Vibe Owl: Preview Staged Diff Risk command reads up to 2000 diff lines and applies the full detection suite. A developer who stages a file containing exec("rm -rf " + userDir) sees the command injection finding in the diff preview before committing, providing an opportunity to fix the pattern before it enters version history.
The diff preview tracks the source of analyzed changes: staged (from git diff --cached), working tree (fallback to git diff when nothing is staged), or none. Git hook scanning provides the enforcement layer — if the developer commits despite the preview warning, the pre-commit hook catches the finding and blocks the commit in block mode.
