Running a shell command from Node without opening an injection hole

You need to call a command-line tool from your script, and the fastest way to do it happens to be the least safe one.

Intermediate to advancedRead 5 minDoing: about 35 minutes5 steps

What you'll have at the end

A script that hands an outside value to a real program through a direct call and an arguments array, tested against six different injection attempts (five shell operators and a flag-like value) with every one landing as a harmless bad-filename error and zero commands run that weren't asked for.

Before you start

You need

A Node script that already takes one value from outside your own code, such as something typed at a prompt or read from an incoming request, and needs to hand that value to a real command-line program it calls out to.

Not covered

Restricting which files or paths a value is allowed to point at in the first place is a separate problem, called path traversal, with its own defenses this recipe does not cover.

Leans on

5 steps

Where to go next

Why does your Node process die silently on a rejected promise?

when the direct-run call is wrapped in a promise and its rejection goes uncaught, the process can end the same silent way this sibling recipe explains.

Checked 25 Aug 2026

Part of the Node.js cookbook