SBD-ALERT-3—Eliminating OS Command Injection Vulnerabilities
>Control Description
CISA Secure by Design Alert (July 10, 2024): Technology manufacturers should eliminate OS command injection vulnerabilities (CWE-78) from their products by using safe APIs that do not invoke shell commands, avoiding string concatenation for OS commands, using parameterized interfaces, and adopting architectural patterns that separate command construction from execution.
>Related Controls
Ask AI
Configure your API key to use AI features.