Node.js child_process exec with a dynamic command string
Rule ID: vetkit.js.command-injection.child-process-dynamic
child_process.exec/execSync runs a command built from a dynamic value through a shell. No untrusted source was traced to it, but if any part of the value can be influenced from outside (request data, CLI arguments, environment, files) this is shell command injection.
Last updated:
Suite: Security
javascript, typescript
child_process.exec/execSync runs a command built from a dynamic value through a shell. No untrusted source was traced to it, but if any part of the value can be influenced from outside (request data, CLI arguments, environment, files) this is shell command injection.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Use execFile/spawn with an argument array and without shell: true; validate inputs against an allow-list.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- Node.js child_process command injection from user input
- Node.js spawn shell: true command injection
- NextAuth allowDangerousEmailAccountLinking enabled
- NextAuth Auth.js debug: true logs tokens in production
- NextAuth Auth.js hardcoded secret in source code
- JavaScript eval() with a dynamic argument: code injection
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.