Popen([..], shell=True, [..]) can be avoided and may be exploitable (command injection)

[hartwork]

Hi!

I found this code: https://github.com/firatkiral/pypeek/blob/ac94d6a21d56a9712db92192374cf73fdff1dacb/src/pypeek/main.py#L1049-L1058 If any of the variables going systemcall can be controlled by an attacker, then this is a command injection vulnerability. Either way, I would resolve needless(?) shell=True here and build a list to call that command, not a flat string.

Thanks, Sebastian

[firatkiral]

@hartwork thank you, looking...

[hartwork]

@firatkiral found 870cd315de1fc928654233e309e102ddab48cc8a about it now, very nice, thank you! :+1: