Command injection: exec.Command with shell wrapper or concatenated argv

What it detects

Command injection: exec.Command with shell wrapper or concatenated argv: an injection check run by the textscan analyzer.

Evidence

The matching source path, line, and bounded code observation produced by the native rule.

Remediation

Pass argv as a list rather than going through `sh -c`. If shell semantics are required, sanitise inputs with shellescape or use os/exec with explicit env+argv.

Limitations

This check is limited to the applicability and evidence delivered by textscan. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions