Shell injection
Named by 2 kept items in this workspace.
Search every workspace for Shell injection. It matches the name as written, so it can find other things that share it.
The items that name it 2
Server-side concatenation of user/trigger-supplied strings into shell commands, e.g. Kestra's ScriptService piping into /bin/sh -c, and Airflow's BashOperator piping Jinja2-rendered dag_run.conf values into subprocess.run(['bash','-c', ...]).
Unauthorized system command execution
All techniques in this workspace.