Command Injection Shell Game
What it is
User-controlled input appears to reach a shell execution sink without allowlist or argv-array evidence.
This usually appears when request-shaped data moves through helper functions until the original trust boundary is no longer obvious.
How to fix it
Avoid shell execution, use argv-array APIs, strict command allowlists, and negative tests for metacharacter injection.
- 1Avoid shell execution; use argv-array APIs with fixed binaries.
- 2Allowlist the commands and arguments the server may run.
- 3Add negative tests for shell metacharacter injection.
How VibeAudit checks for this
VibeAudit checks this with scoped evidence from supported structural checks, external observations, and authorized probes where available. The free tier may show the surface name only, without private evidence or remediation details. Metadata-only surface maps do not create missing-control findings. Unsupported private repositories, authenticated behavior, destructive workflows, account configuration, and business logic remain unverified unless the scan includes matching local, imported, or authorized runtime evidence.
Related failure modes
Check your public launch surface and keep unsupported scope visible.
Run Quick Scan