Zennoxa Shield
Rules / Python
SHIELD-PY-006

Shell injection via subprocess with shell=True

highPythonCWE-78CVSS 8.8

What it detects

Using shell=True with subprocess passes the command to the shell, allowing injection.

How to fix

Use shell=False (default) and pass arguments as a list to avoid shell injection.

Vulnerable — Shield flags thisarchive.py
import subprocess

def archive_logs(log_dir, dest):
    """Compress a log directory into a tarball."""
    subprocess.run("tar czf " + dest + " " + log_dir, shell=True, check=True)
Fixed — scans cleanarchive.py
import subprocess

def archive_logs(log_dir, dest):
    """Compress a log directory into a tarball."""
    subprocess.run(["tar", "czf", dest, log_dir], check=True)

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-006: Shell injection via subprocess with shell=True — Zennoxa Shield