subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
# ─── Install ─────────────────────────────────────────────────────────────────── def run(cmd: str, check=True) -> bool: result = subprocess.run(cmd, shell=True, capture_output=True, text=True) if check and result.returncode != 0: print(f" [WARN] {result.stderr[:100]}") return False- Confidence
- 90% confidence
- Finding
- The installer executes shell commands via subprocess.run(..., shell=True), which is unsafe because shell parsing can turn unexpected characters in interpolated paths or future caller-controlled input into command execution. In this file the current command strings are internally constructed, so exploitation is somewhat constrained, but using shell=True in an installer that writes into user-controlled filesystem locations is still a real command-injection risk pattern.