How do you prevent CAPEC-248?

All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary.

What weaknesses does CAPEC-248 target?

CAPEC-248 exploits 1 CWE weakness, including CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')).

How severe is CAPEC-248?

MITRE rates CAPEC-248 as High severity with medium likelihood of attack.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Meta attack pattern

Stable

CAPEC-248: Command Injection

An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.

Last updated June 1, 2026

High

Typical severity

Per MITRE

Medium

Likelihood of attack

Per MITRE

1

Related weaknesses

CWEs this targets

Overview

CAPEC-248 (Command Injection) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed.

Consequences

What a successful CAPEC-248 attack can achieve.

Execute Unauthorized Commands

Affects: Confidentiality, Integrity, Availability

A successful command injection attack enables an adversary to alter the command being executed and achieve a variety of negative consequences depending on the makeup of the new command. This includes potential information disclosure or the corruption of application data.

How to mitigate it

Defenses that reduce the risk of CAPEC-248.

All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary.
Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter.
Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.

Terminology & mappings

Mapped taxonomies

OWASP Attacks: Command Injection

Frequently asked questions

Common questions about CAPEC-248.

What is CAPEC-248?: An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
How do you prevent CAPEC-248?: All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary.
What weaknesses does CAPEC-248 target?: CAPEC-248 exploits 1 CWE weakness, including CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')).
How severe is CAPEC-248?: MITRE rates CAPEC-248 as High severity with medium likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-248

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing