Qualified static finding recorded.
CodeVetter · local evidence export
Command injection via subprocess shell=True in Python
codevetter-public-benchmark/py-command-injection
detected · high confidence
Verification
No exact-current runtime evidence is included.
No audience validation occurred.
Finding
command injection
subprocess.run is called with shell=True and a string command containing user-controlled host, allowing shell metacharacters to inject arbitrary commands.
source.py:9