[
  {
    "id": "CMD001",
    "pattern": "exec(?:Sync|FileSync)?\\s*\\([^)]*\\+|os\\.system\\s*\\(|exec\\.Command\\s*\\([^)]*\\+",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection (original)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD002",
    "pattern": "spawn\\s*\\([^)]*shell\\s*:\\s*true",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — JS/TS: spawn with shell:true, execa",
    "language": [
      "js",
      "ts"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD003",
    "pattern": "execa(?:\\.command)?\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — JS/TS: spawn with shell:true, execa",
    "language": [
      "js",
      "ts"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD004",
    "pattern": "subprocess\\s*\\.\\s*(?:call|check_output|Popen|run)\\s*\\([^)]*shell\\s*=\\s*True",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD005",
    "pattern": "os\\s*\\.\\s*popen\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD006",
    "pattern": "\\.exec_command\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD007",
    "pattern": "`[^`]*#\\{[^}]+\\}[^`]*`",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD008",
    "pattern": "\\b(?:system|exec)\\s*\\(\\s*[\"'`]?[^\"'`\\n]*#\\{|\\b(?:system|exec)\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD009",
    "pattern": "\\bIO\\.popen\\s*\\(|Open3\\.\\w+\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD010",
    "pattern": "Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
    "language": [
      "kotlin",
      "java"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD011",
    "pattern": "new\\s+ProcessBuilder\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
    "language": [
      "kotlin",
      "java"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD012",
    "pattern": "Process\\s*\\.\\s*Start\\s*\\(|new\\s+ProcessStartInfo\\s*[({]",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — C#: Process.Start / ProcessStartInfo",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD013",
    "pattern": "Command\\s*::\\s*new\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Rust: Command::new",
    "language": [
      "rust"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD014",
    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bpopen\\s*\\(",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD015",
    "pattern": "\\bsystem\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bsystem\\s*\\(\\s*\\$",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD016",
    "pattern": "`[^`]*\\$(?:_GET|_POST|_REQUEST|_COOKIE|\\w+)[^`]*`",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD017",
    "pattern": "exec\\s*\\.\\s*Command\\s*\\([^)]*fmt\\.Sprintf|exec\\s*\\.\\s*Command\\s*\\([^)]*parts\\b",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD018",
    "pattern": "exec\\s*\\.\\s*Command\\s*\\(\\s*[\"']\\/bin\\/(?:sh|bash)[\"']\\s*,\\s*[\"']-c[\"']",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD019",
    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bexec\\s*\\(\\s*\\$",
    "flags": "",
    "category": "command_injection",
    "description": "Command injection — PHP: exec() with user input",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD020",
    "pattern": "ProcessStartInfo\\s*\\{[^}]*Arguments\\s*=\\s*\\$[\"']",
    "flags": "i",
    "category": "command_injection",
    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD021",
    "pattern": "Arguments\\s*=\\s*\\$[\"'][^\"']*\\{(?:host|cmd|args|input|filename|email|script)",
    "flags": "i",
    "category": "command_injection",
    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD022",
    "pattern": "new ProcessStartInfo\\s*\\(\\s*[\"'][^\"']*(?:bash|sh|cmd)[\"']",
    "flags": "i",
    "category": "command_injection",
    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD023",
    "pattern": "`[^`]*#\\{[^`]*`",
    "flags": "",
    "category": "command_injection",
    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD024",
    "pattern": "\\bsystem\\s*\\([^)]*#\\{",
    "flags": "i",
    "category": "command_injection",
    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD025",
    "pattern": "\\bexec\\s*\\([^)]*#\\{",
    "flags": "i",
    "category": "command_injection",
    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD026",
    "pattern": "Open3\\.capture2\\s*\\(.*(?:#\\{|cmd)",
    "flags": "i",
    "category": "command_injection",
    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD027",
    "pattern": "IO\\.popen\\s*\\([^)]*#\\{",
    "flags": "i",
    "category": "command_injection",
    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD028",
    "pattern": "\\bspawn\\s*\\([^)]*#\\{",
    "flags": "i",
    "category": "command_injection",
    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD029",
    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|_POST|host|cmd|ip)",
    "flags": "i",
    "category": "command_injection",
    "description": "PHP command injection",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD030",
    "pattern": "shell_exec\\s*\\([^)]*\\$(?:_GET|_POST|domain|ip|host|cmd|server)",
    "flags": "i",
    "category": "command_injection",
    "description": "PHP command injection",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD031",
    "pattern": "\\bsystem\\s*\\([^)]*\\$(?:_GET|_POST|src|dest|format|file)",
    "flags": "i",
    "category": "command_injection",
    "description": "PHP command injection",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD032",
    "pattern": "passthru\\s*\\([^)]*\\$(?:_POST|_GET|archive|zip|dest)",
    "flags": "i",
    "category": "command_injection",
    "description": "PHP command injection",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD033",
    "pattern": "popen\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|pattern|logfile)",
    "flags": "i",
    "category": "command_injection",
    "description": "PHP command injection",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD034",
    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:bash|sh)[\"'][^)]*\"-c\"",
    "flags": "i",
    "category": "command_injection",
    "description": "Go command injection",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD035",
    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:sh|bash)[\"'][^)]*cmdStr",
    "flags": "i",
    "category": "command_injection",
    "description": "Go command injection",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "CMD036",
    "pattern": "cmd\\s*:=\\s*exec\\.Command\\s*\\([^)]*\\+",
    "flags": "i",
    "category": "command_injection",
    "description": "Go command injection",
    "language": [
      "go"
    ],
    "severity": "critical"
  }
]