Command Injection via child_process
Description
Detects user input flowing to shell command execution functions.
What Shoulder detects
How to fix
Use execFile() with argument arrays instead of exec() with string commands.
```javascript
const { execFile } = require('child_process');
execFile('ls', ['-la', directory]);
```
Learn more: https://shoulder.dev/learn/javascript/cwe-78/command-injection
Applies to
Languages
Frameworks
nodejs
express
fastify
koa
hapi
nestjs
lambda
serverless
graphql
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-command-injection .
Real-world examples
Known CVEs in the OS Command Injection vulnerability class that this rule helps detect.