How severe is exec with untrusted path?

Shield rates this high (CVSS 8.8), classified as CWE-78.

Rules / C/C++

SHIELD-CPP-010

Exec with untrusted path

highC/C++CWE-78CVSS 8.8

execl or execlp invoked with a variable program path may run attacker-controlled binaries.

Use absolute trusted paths and validate arguments before calling exec.

Vulnerable — Shield flags thislaunch.c

#include <unistd.h>

void run_tool(const char *tool) {
    execlp(tool, tool, "--version", (char *)NULL);
}

Fixed — scans cleanlaunch.c

#include <unistd.h>

void run_tool(void) {
    execl("/usr/bin/git", "git", "--version", (char *)NULL);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-010, the fixed one does not.