Summary

Fixes #558 — check_command_exists used subprocess.run(f"which {command}", shell=True) which allowed arbitrary command execution via shell metacharacters.

Changes

• Replaced subprocess.run(f"which {command}", shell=True, ...) with shutil.which(command)
• Added import shutil at the top of the file
• The shutil.which() function is a pure Python implementation that searches PATH without invoking a shell, making it immune to command injection

CWE Reference

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Severity: High

Testing

• Verify that check_command_exists("python3") still correctly reports the command as available
• Verify that check_command_exists("foo; echo pwned") reports the command as unavailable (not executing the injected command)
• Verify that check_command_exists("nonexistent") reports the command as unavailable

Found by SpiderShield security scanner