Description
A command injection vulnerability exists in this LLM-powered web application where user-supplied input is not adequately sanitized. This flaw allows attackers to prepare arbitrary operating system commands and ask the LLM to execute them.
Remediation
Implement strict input validation and sanitization to ensure that user input is never passed directly to OS-level commands. Use parameterized API calls or safe execution libraries, enforce allowlists for acceptable inputs, and review logging and error handling to minimize exposure.