subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
if stripped.startswith("python "): prefix_len = len(normalized_command) - len(stripped) normalized_command = normalized_command[:prefix_len] + sys.executable + stripped[len("python") :] proc = subprocess.run( ["/bin/zsh", "-lc", normalized_command], cwd=str(cwd), text=True,- Confidence
- 99% confidence
- Finding
- This code runs a string command through /bin/zsh -lc, which gives shell metacharacters full effect and allows arbitrary command execution in the target repository. Because apply_command, rollback_command, and benchmark_command can be user-supplied, this creates a direct command-injection and arbitrary code execution path with side effects on the local system and repository contents.