subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 90% confidence
- Finding
The code executes an external Python script from a fixed path under the user's home directory and explicitly forwards the full process environment to that child process. While it avoids shell injection by using an argument list, it still creates a trust-boundary problem: if the referenced script or inherited secrets in environment variables are compromised, running this adapter can execute untrusted code and expose credentials or tokens.
- Content
python script = os.path.join(GS_SCRIPTS_DIR, "gs_stock_market_query.py") try: result = subprocess.run( ["python3", script, "single_hq", "--code", symbol, "--set_code", str(set_code)], capture_output=True, text=True, timeout=20, env={**os.environ}