Zennoxa Shield
Rules / Python
SHIELD-PY-005

Shell injection via os.system

criticalPythonCWE-78CVSS 9.8

What it detects

os.system() with user input allows arbitrary command execution.

How to fix

Use subprocess.run() with a list of arguments and shell=False instead of os.system().

Vulnerable — Shield flags thisping.py
import os

def ping(host):
    """Check that a monitoring target is reachable."""
    return os.system("ping -c 1 " + host)
Fixed — scans cleanping.py
import subprocess

def ping(host):
    """Check that a monitoring target is reachable."""
    result = subprocess.run(["ping", "-c", "1", host], check=False)
    return result.returncode

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-005: Shell injection via os.system — Zennoxa Shield