Command injection: how it works, what are the risks, and how to prevent it

This report explains command injection risks in Node.js applications, using the popular systeminformation npm package (versions <4.27.11) as an example: an insecure inetChecksite() implementation concatenates a sanitized URL into a curl exec() call enabling attacker-controlled arguments (e.g., supplying a space and curl flags) that can lead to arbitrary command execution. The article includes a PoC, notes the patch in 4.27.11, and recommends mitigations such as using execFile(), strict input validation, and avoiding passing user input directly to shell-invoking APIs.