Argument injection is a security flaw where attacker-controlled input changes the options or parameters passed to a command-line program. Unlike classic command injection, the attacker may not need to break out into a shell or add a new command; simply reshaping the arguments can make a fixed executable behave in an unsafe way.
This matters because many tools trust flags and positional parameters to control behavior. If user input becomes an option such as a filename, mode switch, or path, it can trigger unintended actions like reading sensitive files, disabling validation, overwriting data, or contacting a different resource. In real attacks, this often happens when applications build command strings unsafely or pass untrusted values that begin with hyphens. Defenses include avoiding shells, passing arguments separately, using allowlists, inserting -- before user data when supported, and validating that input cannot be mistaken for an option.