{
  "title": "Shell command injection via ping utility",
  "description": "User-supplied host is concatenated into a shell command; shell metacharacters execute arbitrary commands.",
  "severity": "CRITICAL",
  "category": "security",
  "findings": [
    {"file": "app.py", "trigger": "user host concatenated into shell command", "description": "OS command injection via shell=True with unescaped input", "severity": "CRITICAL", "classes": ["CWE-78"]}
  ]
}