Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
The code passes user-controlled input (such as environment variables or command-line arguments) directly to asyncio.create_subprocess_exec without proper sanitization. This allows untrusted data to influence system commands executed by your application.
Impact#
An attacker could inject malicious commands, leading to command execution on the server. This can result in data theft, unauthorized access, service disruption, or full system compromise, putting both your application’s data and infrastructure at risk.