CWE-77: Improper Neutralization of Special Elements used in a Command

Many protocols and products use their own command languages. Consequently, focusing only on OS or shell command strings is insufficient, because special syntax in a custom command language can also change the operation the application intended to perform. The weakness occurs when untrusted data is incorporated into a command and passed to an executing component without appropriate neutralization, allowing the data to terminate the intended command or introduce additional operations.

The defining pattern is untrusted or externally influenced data entering a command string that the product executes or sends to another component, while special characters or syntax are not handled correctly. The target may be an operating-system or shell command, but it may also be a custom protocol or product-specific command language. The weakness typically arises during implementation, when external data becomes part of a string executed as a command.

A malicious user may inject a delimiter, such as a semicolon, that ends the intended command and introduces a different command. This can enable unauthorized code or command execution and grant capabilities or privileges the attacker should not have. The resulting impacts can affect confidentiality, integrity, and availability, depending on the commands that become executable.

Architecture and design: Prefer library calls over external processes when they can provide the required functionality. Implementation: If external commands are necessary, create them statically whenever possible. Validate input using an accept-known-good allowlist that strictly follows the required specification, including length, type, permitted values, syntax, missing or extra fields, relationships between fields, and business rules; reject or transform nonconforming input. Do not rely only on denylists of malicious patterns, although denylists can help detect attacks or reject clearly malformed input. Operation: Enforce an allowlist of sanctioned commands at runtime. System configuration: Assign permissions so users cannot access or open privileged files.

Automated static analysis, commonly called SAST, can find some instances by analyzing source or compiled code without execution. It typically models data flow and control flow, then searches for potentially vulnerable paths connecting input sources with sinks where data interacts with external components or lower layers such as the operating system. This approach has high effectiveness, but it is limited to cases that the analysis can model and recognize.

The following are representative examples, not an exhaustive list:

• CVE-2026-27806: a device management product allowed injection of Tcl/expect commands.
• CVE-2022-1509, CVE-2021-41282, and CVE-2019-13398: allowed injection of sed script syntax.
• CVE-2024-5184: an ML-based email analysis product exposed an API service where a malicious user could inject a direct prompt, take over service logic, and cause system prompts or sensitive data to be disclosed.
• CVE-2020-11698: allowed injection of SNMP commands into a configuration file.
• CVE-2019-12921: allowed command injection in the Magick Vector Graphics (MVG) language.
• CVE-2022-36069: avoided OS command injection while generating Git commands but allowed injection of optional arguments when input began with a dash, a CWE-88 issue that could enable code execution.
• CVE-1999-0067: a canonical OS command injection example in which a CGI program failed to neutralize the | metacharacter when invoking a phonebook program.
• CVE-2020-9054: a chain in which improper input validation in a username parameter led to OS command injection, reportedly exploited in the wild according to CISA KEV.