vetkit.c.command-injection.input-to-shell
A command line built from program arguments, environment variables or received data is run through the shell (command injection).
Last updated:
Suite: Security
c, cpp
A command line built from program arguments, environment variables or received data is run through the shell (command injection).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Start the program directly with fork + execv / posix_spawn and pass each value as its own argv element; never interpolate input into a string that a shell interprets.
References
Source: packages/engine/rules/sast/c.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.