Code projects API executes user-provided commands with `shell=True`

[evzans]

Code projects API executes user-provided commands with shell=True

Severity: Critical
File: backend/app/modules/code/code_projects_api.py:1087

The pipeline step runner executes shell commands using subprocess.run with shell=True. While the command comes from the pipeline configuration, if that configuration can be influenced by user input (e.g., custom plan packages), arbitrary command execution is possible.

def _run():
    return _subprocess.run(
        shell_cmd,
        shell=True,
        capture_output=True,
        text=True,
        timeout=step.timeoutSec,
        cwd=repo_dir,
        env=sanitized_subprocess_env({"PYTHONUNBUFFERED": "1"}),
        encoding="utf-8",
        errors="replace",
    )

Why it matters

A malicious user could craft a plan package with shell metacharacters in step commands, achieving remote code execution on the backend server. The sanitized_subprocess_env only filters environment variables, not command injection.