subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode == 0: return {"success": True, "message": f"{action} 成功"} else:- Confidence
- 97% confidence
- Finding
- Unlike the other subprocess cases, this function constructs a subcommand from unvalidated user input via f"note-{action}". While shell injection is still avoided, an attacker can invoke unintended privileged operations implemented by the downstream script if additional note-* subcommands exist, making this a command-surface expansion issue.