How severe is command injection via system or exec with interpolation?

Shield rates this critical (CVSS 9.8), classified as CWE-78.

Rules / Ruby

SHIELD-RUBY-004

Command injection via system or exec with interpolation

criticalRubyCWE-78CVSS 9.8

Passing an interpolated string to system or exec runs it through a shell, enabling command injection.

Pass command and arguments as separate array elements to avoid shell interpretation.

Vulnerable — Shield flags thisbackup_job.rb

class BackupJob
  def perform(archive_name)
    system("tar -czf /var/backups/#{archive_name}.tar.gz /var/data")
  end
end

Fixed — scans cleanbackup_job.rb

class BackupJob
  def perform(archive_name)
    system("tar", "-czf", "/var/backups/#{archive_name}.tar.gz", "/var/data")
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-004, the fixed one does not.