Operating-system command execution is the ability for software to run shell commands or native system utilities on a server. It becomes a security issue when untrusted input, such as a form field, API parameter, or expression, can influence those commands. In that case, an attacker may move from controlling application data to controlling the host itself.
This matters because command execution can expose files, environment variables, credentials, and network access that the application can reach. In real attacks, it often appears after a sandbox escape, command injection flaw, or unsafe use of functions that pass input into system calls. Defenders reduce the risk by avoiding direct shell invocation, validating and escaping input, running services with minimal privileges, isolating workloads, and monitoring for unexpected process launches from web applications or workflow engines.