dangerous-exec-command

### Description

Detected non-static command inside Command. Audit the input to exec.Command. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

[core/container/externalbuilder/externalbuilder.go#L401)

func (b *Builder) NewCommand(name string, args ...string) *exec.Cmd {
cmd := exec.Command(name, args...)
propagationList := appendDefaultPropagateEnvironment(b.PropagateEnvironment)
for _, key := range propagationList {
if val, ok := os.LookupEnv(key); ok {
cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", key, val))
}
}
return cmd
}

References

https://owasp.org/Top10/A03_2021-Injection

### Steps to reproduce

_No response_