{
  "slug": "os-command-injection",
  "url": "https://library.infinity8labs.com/os-command-injection/",
  "title": "Operating system command injection",
  "short": "OS command injection",
  "aliases": [
    "Shell injection",
    "Command injection",
    "OS command injection"
  ],
  "summary": "OS command injection occurs when untrusted input changes a command executed by the operating system. It can let an attacker run commands with the application's privileges and often leads to full server compromise.",
  "cwe": [
    "CWE-78"
  ],
  "owasp": "A03:2021 Injection",
  "typical_severity": {
    "min": "high",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
      "url": "https://cwe.mitre.org/data/definitions/78.html"
    },
    {
      "title": "OWASP OS Command Injection Defense Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A03:2021 Injection",
      "url": "https://owasp.org/Top10/A03_2021-Injection/"
    },
    {
      "title": "Node.js child_process documentation",
      "url": "https://nodejs.org/api/child_process.html"
    },
    {
      "title": "PortSwigger Web Security Academy: OS command injection",
      "url": "https://portswigger.net/web-security/os-command-injection"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/os-command-injection/#overview",
    "https://library.infinity8labs.com/os-command-injection/#impact",
    "https://library.infinity8labs.com/os-command-injection/#examples",
    "https://library.infinity8labs.com/os-command-injection/#remediation",
    "https://library.infinity8labs.com/os-command-injection/#testing",
    "https://library.infinity8labs.com/os-command-injection/#references"
  ]
}