{
  "node_id": "mitre-cwe-78-os-command-injection",
  "title": "MITRE CWE-78 - Improper Neutralization of Special Elements Used in an OS Command (OS Command Injection)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-05",
  "bluf": "CWE-78 (Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection) is consistently in the CWE Top 25 most dangerous weaknesses and is one of the most exploited weaknesses in network appliances, IoT devices, and admin web applications. CWE-78 is defined as: the product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. The Extended Description identifies two primary variants: (1) a fixed program with user arguments where an application intends to execute a specific program but fails to sanitize user-supplied arguments, allowing attackers to execute additional programs via command separators; and (2) attacker-controlled command selection where applications that allow users to fully specify which program to execute create severe risks because attackers can execute arbitrary commands if input validation is inadequate. The Extended Description notes that if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. Common Consequences include unauthorized operating system command execution, denial of service, unauthorized file read and modification, application data modification, and concealment of malicious activities by making them appear to originate from the application. Impact scope includes Confidentiality, Integrity, Availability, and Non-Repudiation. Primary Mitigations include using library calls instead of external processes where feasible; implementing sandbox or jail environments (chroot, AppArmor, SELinux); using parameterized functions requiring individual arguments rather than single command strings; applying strict input validation with allowlists; implementing output encoding and proper escaping; running code with minimum necessary privileges; and deploying application firewalls for detection.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "industry_mapping",
      "related_frameworks"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-cwe-20-improper-input-validation"
  ],
  "primary_citations_count": 9
}