A subprocess boundary is the handoff between a program and an external process it starts, such as an image library invoking a renderer. At this point, the calling program passes arguments and other input to the child process. Those values must remain data, not be misread as options or instructions by the child program.
This boundary matters because unsafe argument handling can enable injection attacks. For example, if a user-controlled filename is passed to a renderer and parsed as command-line syntax, an attacker may influence the renderer’s behavior. Defenses include using APIs that pass arguments separately rather than through a shell, validating and normalizing input, limiting child-process privileges, and isolating processing. These safeguards reduce risk, but do not replace fixing vulnerable software.