title: Is my bash script vulnerable to command injection?
body: <p>I am in the process of QA'ing a fellow developers bash script.  It looks something like this:</p>
  
  <pre><code>#!/bin/bash
  
  TERM=`cat ./termName.txt` || exit $?
  ./other-script.sh $TERM
  </code></pre>
  
  <p>Given that the <code>TERM</code> variable isn't quoted in the last line, it feels like a malicious user could take advantage of command injection by manipulating the contents of <code>termName.txt</code>, however my basic attempts to prove this are failing to inject any executable commands.</p>
  
  <p>My questions are:</p>
  
  <ol>
  <li>Is this script vulnerable to command injection?</li>
  <li>If yes, can you provide examples of how to execute arbitrary commands.  If no, can you explain why it is safe from command injection? </li>
  </ol>