Page History

...

CVE-2010-0886	Sun Java Web Start Plugin Command Line Argument Injection
CVE-2010-1826	Command injection in `updateSharingD`'s handling of Mach RPC messages
T-472	Mac OS X Java Command Injection Flaw in `updateSharingD` lets local users gain elevated privileges

Related Guidelines

CERT C Secure Coding Standard	ENV03-C. Sanitize the environment when invoking external programs
	ENV04-C. Do not call system() if you do not need a command processor
CERT C++ Secure Coding Standard	ENV03-CPP. Sanitize the environment when invoking external programs ENV04-CPP. Do not call system() if you do not need a command processor
CERT Perl Secure Coding Standard	IDS34-PL. Do not pass untrusted, unsanitized data to a command interpreter
ISO/IEC TR 24772:2013	Injection [RST]
MITRE CWE	CWE-78, Improper neutralization of special elements used in an OS command ("OS command injection")

Runtime.exec() can be called from Android apps to execute operating system commands.

[Chess 2007]	Chapter 5, "Handling Input," section "Command Injection"
[OWASP 2005]	A Guide to Building Secure Web Applications and Web Services
[Permissions 2008]	Permissions in the Java™ SE 6 Development Kit (JDK)

...