Starts a process from caller-controlled arguments; the security boundary depends on argument construction and shell mode.
The pack does not provide a callable signature for this record; the watched access path is shown directly.
| Arg | Access path | Purpose | Watched |
|---|---|---|---|
| Argument[0] | Argument[0] | The access path Atropos marks for this model. | ▲ sink |
External input alters the syntax or behavior of an operating-system command.
An attacker adds separators, substitutions, or flags that turn a value into a second command or alter the first.
Atropos identifies Argument[0] as a command-injection sink. It cannot see whether untrusted data reaches this call in your repository.
Lachesis is the codebase-level step: it traces reachability and guards for this symbol.
Check this symbol in Lachesis →Safer direction: Pass a sequence of fixed executable and arguments, keep shell=False, and constrain executable selection.
subprocess.run(command, shell=True);
subprocess.run([binary, '--input', path], shell=False, check=True);
| Role | Kind | Access path | Model ID | Confidence |
|---|---|---|---|---|
| sink | command-injection | Argument[0] | python.subprocess.run.a0 | high · corrob. 3 |
| sink | command-injection | Argument[1] | python.subprocess.run.a1 | medium · corrob. 2 |
| sink | command-injection | Argument[2] | python.subprocess.run.a2 | medium · corrob. 2 |