Trace command injection through format strings

The universal command injection pattern is a string built from input and handed to a shell. Grep interpolation into exec across languages.

grep -rEn "system(|popen|exec(|os.system|Runtime|Process|subprocess.*shell=True|`.*$" --include=*.{php,py,js,ts,java,rb,go,sh} .

The bug interpolates input into the command.

system("convert " . $_GET['f'] . " out.png");   // f="x; id"

Pro note: argument arrays without a shell are the fix; escaping is fragile and often wrong for quoting edge cases. Watch for indirect shells too, such as libraries that call sh -c internally when given a single string argument.