High severityJavaInjectionHIGH confidence
OS Command Injection Tainted Input
Untrusted request input flows into an OS command executed via Runtime.exec or ProcessBuilder.
Standards mapping
Vulnerable vs. safe
Flagged by this check
Runtime.getRuntime().exec(req.getParameter("cmd"));Passes - the safe pattern
Runtime.getRuntime().exec(new String[]{"/bin/ls", "-l"});Why it matters & how to fix it
Untrusted request input flows into an OS command executed via Runtime.exec or ProcessBuilder. This enables OS command injection (CWE-78/CWE-77). Avoid invoking a shell; pass a fixed program with an argument array of validated tokens and never concatenate user input into the command. Prefer a native library API over shelling out.
References
Rule ID integsec-java-os-command-injection-taint - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - InjectionCode Injection Tainted Input
- JavaScript / TypeScript - InjectionEval Dynamic Argument
- JavaScript / TypeScript - InjectionNoSQL Query From Request
- JavaScript / TypeScript - InjectionNoSQL Where Operator
- JavaScript / TypeScript - InjectionOS Command Injection Tainted Input
- JavaScript / TypeScript - InjectionSQL Injection String Concatenation