Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-003

Command injection via Runtime.exec with variable

criticalKotlinCWE-78CVSS 9.8

What it detects

Runtime.getRuntime().exec invoked with an interpolated or concatenated variable allows OS command injection.

How to fix

Avoid shell execution with untrusted input; use a fixed argument array and validate inputs against an allowlist.

Vulnerable — Shield flags thisCmd.kt
fun ping(host: String) {
    Runtime.getRuntime().exec("ping -c 1 $host")
}
Fixed — scans cleanCmd.kt
fun ping(host: String) {
    require(host.matches(Regex("^[a-zA-Z0-9.-]+$"))) { "invalid host" }
    ProcessBuilder("ping", "-c", "1", host).start()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-003: Command injection via Runtime.exec with variable — Zennoxa Shield