CVE-2026-26029: Node Exec Dynamic Command Injection
Unsafe execution of dynamic commands using `child_process.exec`. Shell metacharacters can be used for command injection. Use `trim`, `spawn` or `execFile` instead to pass arguments safely as an array instead of a concatenated shell string.
Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0typescript
greprules fetch cve-2026-26029-node-exec-dynamic-command-injection --engine opengrepDescription
Unsafe execution of dynamic commands using `child_process.exec`. Shell metacharacters can be used for command injection. Use `trim`, `spawn` or `execFile` instead to pass arguments safely as an array instead of a concatenated shell string.
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.