subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
def run_cli(args: str) -> tuple[dict, int]: """运行 CLI 命令并返回 JSON 结果和退出码""" cmd = f'uv run python -m qvxianjiuguo.cli {args}' result = subprocess.run( cmd, shell=True, capture_output=True,- Confidence
- 97% confidence
- Finding
- The helper builds a shell command by interpolating the caller-provided args string into cmd and executes it with shell=True. Even though this is a test file, any attacker-controlled or unexpectedly modified argument string could trigger shell metacharacter injection and arbitrary command execution in the test environment.