Developers often build command strings by inserting user input directly into a template, assuming only their specified arguments will run. They might even guard against obvious command injection by escaping shell metacharacters like semicolons or ampersands. However, if they don't also neutralize characters that separate arguments—such as spaces, commas, or hyphens—an attacker can sneak in entirely new flags or parameters. For example, inputting `file.txt --mode destructive` could be interpreted as two separate arguments, not a single filename. The security impact depends on what the targeted command supports. Injected arguments can delete files, expose sensitive data, change system configurations, or bypass security checks. This flaw is subtle because the command itself isn't hijacked; instead, its intended behavior is altered by providing it with more—and potentially malicious—options than the developer planned for.