subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
return resolved probe_cmd = f"where {command}" if os.name == "nt" else f"command -v {command}" probe = subprocess.run( probe_cmd, shell=True, text=True,- Confidence
- 93% confidence
- Finding
- The command probe uses subprocess.run with shell=True and interpolates the command name directly into a shell string. Although current callers pass fixed values like 'pwsh', 'powershell', 'bash', and 'sh', the helper is generic and unsafe by design; if reused with attacker-controlled input, it enables shell metacharacter injection and arbitrary command execution.