OS Command Injection

Description

Detects untrusted user input flowing into operating system command execution functions without proper sanitization.

How to fix

Use subprocess with argument lists and shell=False.

```python
subprocess.run(["ping", "-c", "2", ip_address], check=True)
```

Learn more: https://shoulder.dev/learn/python/cwe-78/command-injection

Applies to

References

Scan for this issue

Real-world examples

Known CVEs in the OS Command Injection vulnerability class that this rule helps detect.

Related rules