What design mistake creates a command injection vulnerability?
Unsafe user input is incorporated into a command interpreted by a system shell.
The application transmits requests over TLS.
User input is kept strictly as data and passed without shell interpretation.
A server returns a static HTML page without running commands.