flawopen.com/Command Injection/Node child_process.exec

Is Node's child_process.exec() safe?

Reference page — draft, pending review
Short answer

Not if the command string includes untrusted input — like Python's os.system(), exec() always runs its string through a shell.

VULNERABLE
exec(`convert ${filename} out.png`,
  (err, stdout) => { ... })
FIXED
execFile('convert',
  [filename, 'out.png'],
  (err, stdout) => { ... })

Why the fix works

execFile() runs the named executable directly with an argument array, with no shell involved — shell metacharacters in filename are passed as literal characters of that one argument, never interpreted as command separators. exec() always shells out, which is exactly why it accepts a single command string instead of a program name plus arguments.

FAQ

What about execSync?

Same risk as exec() — it's the synchronous version of the same shell-based function, and execFileSync is its safer counterpart.

References