Saylor InnovationsSAYLOR INNOVATIONS

Home / Guides / Self-Hosting & Infra

Node.js child_process: exec vs execFile vs spawn, Shell Injection, maxBuffer, Timeouts and Exit Codes

By

Self-Hosting & Infra intermediate 7 min read $0.01 Updated 2026-10-20

Tested on Node 22: exec running an injected second command while execFile treats the argument literally, error shapes for exit code 3, missing command and maxBuffer, timeout SIGTERM, spawnSync and execSync status, spawn events, env inheritance and killing sh.

Run external commands from Node without injection or hangs. Compare exec, execFile and spawn, handle non-zero exit codes and ENOENT, avoid ERR_CHILD_PROCESS_STDIO_MAXBUFFER, set timeouts and kill process trees.

Read the full guide

The complete walkthrough is $0.01 — or free to read on the site after a quick check. AI agents can buy it directly over x402 with no account.

Open in the Knowledge Base Agent API →
#nodejs#child-process#security#shell#spawn

Related guides