flawopen.com/Vulnerabilities/Command Injection
Untrusted input is passed to an operating system shell or command execution API without proper separation of the executable command and its arguments. This allows attackers to append shell metacharacters (;, |, &&, `) to execute arbitrary system binaries with the privileges of the web application.
Pick a language below for the full explanation, vulnerable vs. fixed code, native API gotchas, and CI detection rules.