OS Command Injection

When user-supplied data is concatenated into a string that's passed to a shell interpreter, characters like ; | & $() let an attacker append entirely new commands — turning a "ping this hostname" feature into a remote shell.

Try this attack in the Playground

Shell metacharacters (; | && $() backticks) let one string carry multiple, sequential commands

The fix is not escaping those characters — it's never invoking a shell at all for this call

Passing arguments as an array to an exec-family call that skips the shell (execve-style) is immune to injection by construction, because there's no shell to parse metacharacters

Allowlisting the specific, narrow set of valid inputs (e.g. a hostname regex) is a strong second layer even when a shell truly can't be avoided

Want this flow explained in detail as it plays?

POST/api/network-tools/ping

Headers

Host:app.flowground.dev

Content-Type:application/json

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

const { exec } = require("child_process");
exec(`ping -c 4 ${req.body.host}`, (err, stdout) => {
  res.send(stdout); // req.body.host reaches a real shell, metacharacters and all
});