Trace command injection through format strings
Any place a shell command is assembled from input with interpolation is injectable regardless of language.
Tag: command-injection
Review Go for command and template injection
exec with sh -c, and text/template used where html/template is required, are the two classic Go review findings.
Review Node child_process and dynamic requires
exec with a string, dynamic require, and vm without a sandbox are the Node sinks that turn input into code.
Catch Python’s unsafe loaders and shell calls
pickle.loads, yaml.load, and subprocess with shell True are the three highest-yield greps in a Python review.