vetkit.py.command-injection.implicit-shell

A non-literal command is passed to an API that always runs it through /bin/sh (subprocess.getoutput, asyncio.create_subprocess_shell). This allows OS command injection.

Last updated: 2026-11-01

Suite: Security

python

A non-literal command is passed to an API that always runs it through /bin/sh (subprocess.getoutput, asyncio.create_subprocess_shell). This allows OS command injection.

Category: SECURITY · Engine rule severity: ERROR

How to fix it

Use subprocess.run / asyncio.create_subprocess_exec with an argument list; never interpolate untrusted values into a shell command line.

References

https://docs.python.org/3/library/subprocess.html#subprocess.getoutput
https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_shell

Source: packages/engine/rules/sast/python.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.