Command Injection Detection — ShipSafe
How ShipSafe detects command injection vulnerabilities in your code.
89 detection rulesLocal-only scanning
What is Command Injection?
Command injection occurs when an application passes untrusted user input to a system shell command. Attackers can execute arbitrary commands on the server, potentially taking full control of the system, reading sensitive files, or pivoting to other systems on the network.
What ShipSafe Detects
- ✓exec() and execSync() with user-controlled arguments
- ✓child_process.spawn() with shell: true and user input
- ✓Template literals or string concatenation in shell commands
- ✓Argument injection through unsanitized flags and options
- ✓PATH manipulation via environment variable injection
- ✓Python os.system(), subprocess.call() with shell=True
- ✓Indirect command injection through file names and environment variables
Example: Vulnerable Code
Vulnerable file conversion endpoint with command injection
// Vulnerable: user input in shell command
app.post("/convert", async (req, res) => {
const { filename } = req.body;
const { exec } = require("child_process");
exec(`ffmpeg -i uploads/${filename} output.mp4`, (err, stdout) => {
res.json({ status: "converted" });
});
});
// An attacker sends filename: "video.mp4; rm -rf /"ShipSafe Catches It
$ shipsafe scan
CRITICAL command-injection/exec-with-user-input
src/routes/convert.ts:4
User input from req.body is interpolated into shell command via exec().
Fix: Use execFile() with an argument array instead of exec() with string interpolation.
execFile("ffmpeg", ["-i", `uploads/${filename}`, "output.mp4"])Detect Command Injection in Your Code
Install ShipSafe and scan your project in under 60 seconds.
npm install -g @shipsafe/cli