highUser input reaching your database or shell

Shell Command Built From Variables

A shell command is put together from variables and handed to a shell.

Why it matters

Characters such as ; | and $( ) mean something to the shell, so whatever lands in the string is executed rather than passed along as text. Giving subprocess a list of arguments with no shell removes the interpretation entirely, and the command still runs exactly as you intended.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

os.system with an f-string

os.system(f"convert {filename} out.png")

The smallest fix

minimal patch

import subprocess
# Arguments in a list; no shell parses them
result = subprocess.run(["ping", "-c", "1", host], capture_output=True, text=True, check=False)

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative

# Prefer a library over a shell call where one exists (Pillow instead of
# ImageMagick, GitPython instead of git commands). If you truly need a
# shell feature, validate the input against a strict pattern first and
# quote it with shlex.quote().

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] a shell command is built from variables: [the flagged code]. Replace os.system / shell=True with subprocess.run and a list of arguments so no shell is involved. If a value comes from user input, validate it against an allow-list or a strict pattern before it reaches the command. Add a test that passes a value containing a semicolon and asserts it is treated as plain text.

How to check the fix worked

1. Call the feature with an input that contains "; echo test" and confirm
   nothing extra runs and the input is used literally.
2. Confirm the normal case still works.