<< Back to security report
Repositoryahundt/autorun →
Commit4794429 →
VerdictFAIL
Score35
DateOct 11, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | ahundt/autorun/parallel-subagent-605cd2d7/plugins/autorun/hooks/hook_entry.py:1324 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | ahundt/autorun/parallel-subagent-605cd2d7/plugins/autorun/src/autorun/installer/entrypoint.py:833 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | ahundt/autorun/parallel-subagent-605cd2d7/plugins/autorun/src/autorun/integrations.py:534 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | ahundt/autorun/parallel-subagent-605cd2d7/plugins/autorun/src/autorun/tmux_utils.py:585 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | ahundt/autorun/parallel-subagent-605cd2d7/plugins/autorun/src/autorun/tmux_utils.py:591 → |