VBC-938: command-injection-risk

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security ai-error

What it reports

Potential command injection at line {line}. Shell commands constructed with string interpolation or concatenation allow attackers to execute arbitrary commands. Use parameterized commands (e.g. execFile with an args array) and never interpolate untrusted input into shell strings.

Flagged

exec(`ls ${userDir}`);

Not flagged

execFile('ls', [userDir]);

Pattern

(exec|execSync|spawn|spawnSync|system|popen)\s*\(\s*[`'"][^`'"]*\$\{|child_process\.(exec|execSync)\s*\(\s*[^)]*\+