If a web server accepts input from the user and passes it to a bash shell, to which attack method is it vulnerable?

Input validation is a defensive control or category of vulnerability, not an attack method itself.

Hash collision attacks target cryptographic hash functions to find two inputs with the same hash output, unrelated to shell execution.

Command injection occurs when user-supplied data is passed to a system shell without sanitization, allowing an attacker to append or substitute malicious commands (e.g., using semicolons or pipes). Because the shell interprets the injected text as a legitimate command, the attacker can read files, exfiltrate data, or gain a shell. This is the direct technical consequence of passing user input to bash without validation or escaping.

Integer overflow is a memory/arithmetic vulnerability caused by exceeding the maximum value a data type can hold, not related to shell input handling.