diff --git a/.github/workflows/coverity-ss-action.yml b/.github/workflows/coverity-ss-action.yml
index 2a3b8ba5..a65161c2 100644
--- a/.github/workflows/coverity-ss-action.yml
+++ b/.github/workflows/coverity-ss-action.yml
@@ -29,10 +29,10 @@ jobs:
         coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
         coverity_policy_view: ${{ github.event_name != 'pull_request' && 'Outstanding Issues' || '' }}
         coverity_prComment_enabled: true
-        coverity_build_command: mvn -B -DskipTests package
-        coverity_clean_command: mvn -B clean
+        coverity_build_command: sh -c "cd subdir && mvn -B -DskipTests package"
+        coverity_clean_command: sh -c "cd subdir && mvn -B clean"
         coverity_local: true
         coverity_install_directory: /opt/coverity/analysis/2025.12.1
         github_token: ${{ secrets.GITHUB_TOKEN }}
         include_diagnostics: true
-        project_directory: subdir
+        #project_directory: subdir
diff --git a/src/main/java/CommandInjection.java b/src/main/java/CommandInjection.java
new file mode 100644
index 00000000..71cec828
--- /dev/null
+++ b/src/main/java/CommandInjection.java
@@ -0,0 +1,13 @@
+// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html
+
+import java.io.*;
+import javax.servlet.http.HttpServletRequest;
+
+public class CommandInjection {
+    public static Process runCmd(HttpServletRequest request) throws IOException {
+        String command = request.getParameter("command");
+        ProcessBuilder builder = new ProcessBuilder("sh", command);
+        Process process = builder.start();
+        return(process);
+    }
+}