How to Fix CWE-78: OS Command Injection

Step-by-Step Remediation

1. Use language-native APIs instead of shell commands (e.g., fs.rename instead of mv)
2. If shell commands are unavoidable, use parameterized execution (subprocess with list args)
3. Never pass user input directly to shell interpreters
4. Implement strict input validation with allowlists
5. Run applications with minimal OS privileges

Code Example

# VULNERABLE: Shell injection
os.system(f"ping {user_input}")

# SAFE: Parameterized subprocess
subprocess.run(["ping", "-c", "1", user_input], shell=False)

Recent Vulnerabilities (CWE-78)

46 vulnerabilities in our database match OS Command Injection.