OS command injection
Summary: PortSwigger describes OS command injection as a critical vulnerability that arises when an application incorporates user-controllable data into an operating system command processed by a shell interpreter, letting an attacker use shell metacharacters to inject arbitrary commands. The result can be complete control over the affected web site and underlying server, including reading or modifying all of its data and performing privileged actions.
Why it matters: The source notes an attacker can pivot from a compromised web server into the organization's internal infrastructure, reaching any system the server can access, and can create a persistent foothold that survives after the original vulnerability is fixed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026