diff --git a/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
index b74752f24..d72aac0c9 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
@@ -67,7 +67,11 @@ StringBuilder getResponseFromPingCommand(String ipAddress, boolean isValid) thro
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/CI_Level1")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam(IP_ADDRESS) String ipAddress) throws IOException {
-        Supplier<Boolean> validator = () -> StringUtils.isNotBlank(ipAddress);
+        Supplier<Boolean> validator =
+                () ->
+                        StringUtils.isNotBlank(ipAddress)
+                                && (IP_ADDRESS_PATTERN.matcher(ipAddress).matches()
+                                        || ipAddress.contentEquals("localhost"));
         return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
                 new GenericVulnerabilityResponseBean<String>(
                         this.getResponseFromPingCommand(ipAddress, validator.get()).toString(),