OS Command Injection occurs when an application dynamically constructs operating system (OS) commands using untrusted inputs, enabling an attacker to execute arbitrary commands on the host system. These commands often run with the same privileges as the application, amplifying the potential impact.
A Content Security Policy is akin to a ‘content filter’ for websites, allowing only specified, trusted sources to load and execute content. By defining a set of rules that control the origins from which resources can be loaded, CSP prevents attackers from injecting or executing harmful code within a web page. Without strict CSP enforcement, attackers can exploit vulnerabilities to exfiltrate sensitive data, capture keystrokes, or redirect users to phishing sites.