Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

command injection

Tricking a program into running extra operating-system commands by hiding them in its input.

Command injection occurs when untrusted input is concatenated into a shell command line; pass arguments as a list (ProcessStartInfo.ArgumentList) and avoid the shell.

Examples

  • A file name of report.txt; shutdown now pasted into a shell command, which then runs shutdown as well.

See also

SQL injection untrusted input
Read the full section →