What is OS command injection, and how to prevent it?
Summary: OS command injection, also called shell injection, lets an attacker execute operating system commands on the server running an application, typically fully compromising the application and its data and often allowing a pivot to other systems through trust relationships. PortSwigger illustrates it with a shopping application that passes product and store IDs to a shell command, where an attacker submitting a payload with the & separator causes three commands to run in sequence and returns the output to the user.
Bottom line: The article's core guidance is to never call out to OS commands from application-layer code, and to avoid escaping shell metacharacters as a fix because it is too error-prone and can be bypassed by a skilled attacker - so any application still shelling out with user input is carrying a compromise path to its data and the wider hosting infrastructure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026