Note that this code is also vulnerable to a buffer overflow (CWE-119).
In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a NULL pointer exception when it attempts to call the trim() method.
(bad code)
String cmd = System.getProperty("cmd");