How do you run external processes with child_process?

Question

Accepted Answer

The **`child_process`** module lets Node run **other programs/commands** (shell commands, scripts, other binaries) as separate OS processes. Useful for invoking system tools, running CPU-heavy work outside the main process, or orchestrating other programs.

## The four main methods

```text
exec      → run a shell command, buffer all output (simple, small output)
execFile  → run a file directly (no shell — safer, faster)
spawn     → stream output (for large output / long-running processes)
fork      → spawn a new NODE process with an IPC channel (Node-to-Node)
```

## exec — simple, buffered

```js
import { exec } from "child_process";

exec("ls -la", (err, stdout, stderr) => {
  if (err) return console.error(err);
  console.log(stdout); // the entire output, buffered into memory
});
```

`exec` is convenient for short commands but buffers all output — risky for commands producing large output (can exceed the buffer limit).

## spawn — streaming (for large/continuous output)

```js
import { spawn } from "child_process";

`spawn` streams output as it's produced (constant memory) and takes arguments as an **array** (not a shell string) — the right choice for long-running or high-output processes.

## The security warning: command injection

```js
// ❌ DANGEROUS — user input in a shell command enables injection
exec(`convert ${userFilename} out.png`); // userFilename = "; rm -rf /" → disaster

// ✅ use execFile/spawn with an args array — no shell interpolation
execFile("convert", [userFilename, "out.png"]); // args passed safely, not parsed by a shell
```

Never interpolate untrusted input into an `exec` shell string — it enables **command injection**. Use `execFile`/`spawn` with an arguments array so input is passed as data, not shell syntax.

## Promise-based usage

```js
import { promisify } from "util";
const execAsync = promisify(exec);
const { stdout } = await execAsync("git rev-parse HEAD");
```

## Why it matters

`child_process` lets Node integrate with the wider system — running CLI tools (git, ffmpeg, imagemagick), offloading CPU-heavy tasks to separate processes (avoiding blocking the event loop), and orchestrating other programs.

Knowing which method to use (`spawn` for streaming/large output, `exec` for simple commands, `fork` for Node subprocesses) and — critically — the **command-injection risk** of `exec` with user input (mitigated by `execFile`/`spawn` with arg arrays) is essential for using it both effectively and securely.