Cybersecurity glossary
What is Argument Injection?
Learn what argument injection is, how untrusted input becomes dangerous CLI flags or positional arguments, how it differs from command injection, and how to prevent unsafe argument construction.
Definition
Argument Injection is a vulnerability in which untrusted input is passed as arguments to an external program or interpreter in a way that changes how that program parses its options—typically by injecting extra flags, option terminators, or unexpected positional values—without necessarily injecting a full shell command.
Why argument injection matters
Teams often harden against classic command injection by switching from system("tool " + input) to an argv array. That is progress—but it is not the finish line. Many utilities interpret leading dashes as options. If a user-controlled path becomes --output=/tmp/pwned, the program may write somewhere unexpected, load a hostile config, or skip safety checks.
Argument Injection is the class of bugs where the argument vector is attacker-influenced, not the shell grammar. Impact ranges from quiet integrity failures to full compromise when the invoked tool is powerful.
How argument injection works
App invokes an external tool
A feature calls convert, git, ffmpeg, curl, or another binary with constructed arguments.
User data becomes an argv entry
A filename, URL, or format string from the request is placed into the argument list.
Option parser is confused
Values starting with - or containing option-like tokens are treated as flags, not data.
Behavior diverges from intent
Wrong files are read or written, configs are overridden, or dangerous modes are enabled.
Typical injection shapes
Leading-dash operands
A 'filename' like -o/tmp/x or --help changes flags instead of selecting a file.
Option terminator bypass
Missing -- before untrusted operands lets the child treat data as options.
Delimiter smuggling
Newlines or spaces in poorly joined argument strings create extra argv slots.
Trusted-tool abuse
A legitimate binary with hostile flags can overwrite paths the app can access.
Controls that actually help
| Control | Notes |
|---|---|
| Prefer libraries over CLI | In-process APIs avoid argv parsing entirely when available |
| Insert -- before operands | Forces subsequent tokens to be treated as data by common Unix tools |
| Reject leading dashes | Validate that paths and names do not start with - |
| Allowlist arguments | Never let users choose option names or arbitrary flag sets |
| Fixed working directories | Resolve paths under a sandbox root before passing them |
| Drop privileges / jail | Limit what a mis-invoked tool can reach if args go wrong |
- Inventory every place the app spawns a process with user-influenced strings.
- Pass argv arrays—never build a single shell string for these calls.
- Place -- immediately before any untrusted positional arguments.
- Normalize and allowlist filenames; reject names beginning with -.
- Do not map query parameters onto CLI flags or config keys.
- Add regression tests that supply --option-looking values as filenames.
- Prefer native libraries (image, PDF, archive) over shelling out when possible.
- Treat successful argument injection as a high-severity finding until impact is proven limited.
The practical takeaway
Argument injection happens when untrusted data reshapes how a child program parses its options. Escaping for the shell is not enough—validate operands, terminate option lists, and avoid CLI wrappers when a library will do.
If your feature passes user filenames into an external binary, assume those names will try to look like flags until your tests prove otherwise.
Related security terms
Command Injection
Broader class where input alters shell or command execution semantics.
OS Command Injection
Injection that reaches the operating system command interpreter.
Code Injection
When untrusted data is evaluated as application code rather than as process args.
File Upload Vulnerability
Upload pipelines often pass filenames into CLI tools and inherit argument risks.
Frequently asked questions
What is argument injection in simple terms?
The application runs a trusted program with user-influenced arguments. An attacker crafts those arguments so the program sees extra options or different files than the developer intended—even when no shell metacharacters are used.
How is argument injection different from command injection?
Command injection usually abuses a shell to run additional commands (pipes, backticks, ;). Argument injection abuses the target program’s own option parser—for example turning a filename into --config=/evil—without needing a shell.
Why does starting with -- matter?
Many Unix tools treat arguments after -- as operands, not options. Without that terminator, a value that starts with - can be parsed as a flag and change program behavior.
Which features are commonly affected?
Image converters, PDF renderers, git helpers, backup tools, antivirus scanners, and any feature that shells out with user-controlled paths, URLs, or format strings.
Does escaping for the shell stop argument injection?
No. Shell escaping prevents command injection when a shell is involved, but if you pass argv arrays directly, the child process still receives the attacker’s flags as separate arguments.
What is the primary defense?
Prefer library APIs over CLI wrappers, allowlist arguments, place -- before untrusted operands, reject leading dashes in filenames, and never map user input onto option names.
Can containers or seccomp fully mitigate it?
They reduce blast radius but do not fix incorrect argument construction. A malicious flag can still delete files inside the container or exfiltrate data the process can reach.
References
Explore authoritative guidance and frameworks related to argument injection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.