potential command injection vulnerability in the process execution logic where user input is directly embedded into a command string.

I found a potential command injection vulnerability in the process execution logic where user input is directly embedded into a command string.

In the current implementation, user-provided input (such as a URL) is concatenated into a shell command without proper validation or sanitization.

For example:

std::string chromeCmd = "chrome --app="" + input["url"].getstd::string() + """; system(chromeCmd.c_str());

This approach is unsafe because specially crafted input can break out of the intended command structure and inject additional arguments or commands.

This issue can occur in:

applications that accept external or user-provided input
malicious or malformed input containing special characters
any scenario where command strings are constructed dynamically

Why this happens
The implementation relies on string concatenation to build system commands, which allows user input to influence command execution directly.

The current code does not sanitize or escape dangerous characters, and it uses shell-based execution (system()), which is inherently unsafe for untrusted input.

Suggested fix
Avoid constructing shell commands using raw strings and instead use safer process execution methods:

std::string url = sanitizeUrl(input["url"].getstd::string()); std::vectorstd::string args = {"--app=" + url};

launchProcess("chrome", args);

Additionally, validate input by rejecting unsafe characters:

std::string sanitizeUrl(const std::string& u) { if(u.find('"') != std::string::npos || u.find('&') != std::string::npos || u.find(';') != std::string::npos || u.find('|') != std::string::npos) { throw std::runtime_error("Invalid URL"); } return u; }

This ensures that command execution is safe and prevents injection vulnerabilities.