Tag

subprocess

Safeguard articles tagged "subprocess" — guides, analysis, and best practices for software supply chain and application security.

1 article

Command injection in Python: subprocess, os.system, and safe-by-default patterns

os.system() and subprocess.run(shell=True) both hand a string straight to /bin/sh — one unescaped semicolon is enough to run arbitrary commands.