Command Injection Vulnerabilities

Updated

October 31, 2026

Command Injection Vulnerabilities

Never pass unsanitized input to eval or execute unquoted command substitutions:

# DANGEROUS: If user_input is "test; rm -rf /", eval executes both!
eval "echo $user_input"

# SAFE: Never use eval with untrusted input
printf '%s\n' "$user_input"