BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback

Command Injection via child_process

Description

Detects user input flowing to shell command execution functions.

What Shoulder detects

Untrusted input from {source} reaches command execution at {sink}. This allows an attacker to execute arbitrary commands on the server.

How to fix

Use execFile() with argument arrays instead of exec() with string commands.

```javascript
const { execFile } = require('child_process');
execFile('ls', ['-la', directory]);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-78/command-injection

Applies to

Frameworks

nodejs express fastify koa hapi nestjs lambda serverless graphql

References

Scan for this issue

Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-command-injection .

Real-world examples

Known CVEs in the OS Command Injection vulnerability class that this rule helps detect.

Related rules