Review Go for command and template injection

Go’s exec.Command is safe with separate args but dangerous through a shell. And text/template does not escape HTML, so using it for web output is XSS.

grep -rEn "exec.Command("(sh|bash)", *"-c"|text/template" --include=*.go .

The bugs are a shell string and the wrong template package.

exec.Command("sh","-c","ping "+host)          // injection via host
t := template.New("x") // text/template -> no HTML escaping in web response

Pro note: run gosec for a fast pass, but confirm findings by hand since it flags patterns, not reachability. For web output always require html/template; for shelling out, pass args as a slice and never build a command line string.