Patched code sample

import subprocess
from typing import List

def install_packages(package_names: List[str]):
    """
    This function represents a patched version of the install_packages method,
    fixing a command injection vulnerability like the one described in the
    hypothetical CVE-2026-12530.

    The fix involves passing command arguments as a list, which prevents the
    shell from interpreting special characters in the package names.
    """
    # The command and its primary argument are defined in a list.
    # Using 'python -m pip' is often more robust than just 'pip'.
    command = ["python", "-m", "pip", "install"]

    # The untrusted package names are appended to the command list.
    # Each item is treated as a single, distinct argument. Shell metacharacters
    # like ';' or '&&' within a package name are not executed. This is the
    # core of the fix that neutralizes the vulnerability.
    command.extend(package_names)

    # By using subprocess.run with a list of arguments (the default behavior,
    # where shell=False), we avoid passing the command through a shell.
    # This prevents a crafted package name like "some-package; id" from
    # executing the 'id' command. The system will instead safely look for
    # a non-existent package named "some-package; id" and fail gracefully.
    subprocess.run(command, check=True)