cmdi_prescan report — 6 file(s), 21 finding(s)

HIGH   CI-SHELL-TRUE    app.py:14  shell=True with non-literal command
       | subprocess.run('convert ' + f + ' out.png', shell=True)
HIGH   CI-SHELL-TRUE    app.py:19  shell=True with non-literal command
       | subprocess.Popen(
HIGH   CI-REQ-EXEC      run.php:3  request-controlled value reaches shell exec
       | system('ping -c1 ' . $_GET['ip']);
HIGH   CI-REQ-EXEC      tool.go:6  request-controlled value reaches shell wrapper
       | exec.Command("sh", "-c", c.Param("cmd"))
HIGH   CI-SHELL-WRAP    tool.go:6  shell wrapper given request-controlled command
       | exec.Command("sh", "-c", c.Param("cmd"))
HIGH   CI-REQ-EXEC      util.js:4  request-controlled value reaches shell exec
       | exec('convert ' + req.query.img + ' -resize 50% out.png', cb);
HIGH   CI-REQ-EXEC      util.js:8  request-controlled value reaches exec
       | execFile('git', ['clone', req.body.url]);
HIGH   CI-REQ-EXEC      util.js:12  request-controlled value reaches shell wrapper
       | execFile('bash', ['-c', req.params.cmd]);
HIGH   CI-SHELL-WRAP    util.js:12  shell wrapper given request-controlled command
       | execFile('bash', ['-c', req.params.cmd]);
MEDIUM CI-EXEC-NONLIT   app.py:9  shell-exec sink called with non-literal arg
       | os.system('ping -c1 ' + host)
MEDIUM CI-EVAL-NONLIT   app.py:26  dynamic eval of a non-literal expression
       | eval(tpl)
MEDIUM CI-SHELL-WRAP    app.py:44  shell wrapper given a non-literal command tail
       | subprocess.run(['sh', '-c', cmd])
MEDIUM CI-PIPE-SHELL    deploy.sh:2  download piped to a shell/interpreter
       | curl -fsSL https://get.example.com/install.sh | bash
MEDIUM CI-EXEC-NONLIT   deploy.sh:3  shell eval of a variable
       | eval "$EXTRA_FLAGS"
MEDIUM CI-EXEC-NONLIT   run.php:4  interpolated value inside shell backtick/%x/qx
       | $out = `nslookup $host`;
MEDIUM CI-EVAL-NONLIT   run.php:10  dynamic eval of a non-literal expression
       | eval($code);
MEDIUM CI-SPAWN-ARG     tool.go:10  user-flavoured arg reaches no-shell exec — argument-injection review
       | exec.Command("git", "clone", url)
MEDIUM CI-SPAWN-ARG     util.js:16  user-flavoured arg reaches no-shell exec — argument-injection review
       | spawn('git', ['clone', repo]);
MEDIUM CI-EVAL-NONLIT   util.js:20  dynamic eval of a non-literal expression
       | return new Function('x', src);
LOW    CI-EXEC-NONLIT   app.py:35  shell-exec sink called with non-literal arg
       | os.system('ping -c1 ' + shlex.quote(host))
LOW    CI-EXEC-NONLIT   run.php:8  shell-exec sink called with non-literal arg
       | system('ping ' . escapeshellarg($h));

scope: deterministic pre-scan — flags patterns for review; not an audit, clean != injection-safe