Command Injection Risk Calculator

Likelihood = mean(invocation style, argument validation, endpoint reachability, execution auditing); impact = mean(process privileges, runtime isolation). The single biggest factor is whether a shell is involved at all: passing an argument array to execve removes the metacharacters that make injection possible, which is why it scores 1 while string concatenation scores 9. Impact is what the resulting shell inherits — the account's privileges and whatever the sandbox still lets it touch.

Command injection converts directly into remote code execution, so the gap between a hardened container running as nobody and a root process on the host is the gap between a contained incident and a breach.

This calculator takes 6 inputs: How the command is invoked, Validation of the user-controlled argument, Reachability of the endpoint, Process execution auditing, Privileges of the process account, Runtime isolation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

It is a fallback, not a fix. Escaping has to be correct for the exact shell, quoting state and locale, and one missed case restores full injection. Removing the shell removes the whole vulnerability class, and every mainstream language offers an argument-array API for it.