Command Injection occurs when unsanitised input is passed to a system shell, enabling arbitrary OS command execution.
Example: ping -c 1 <input> → 8.8.8.8; cat /etc/passwd.
Mitigation
Avoid shell=True, use subprocess with argument arrays, strict input validation.