Vulnerable code sample

import subprocess
import configparser

# This function is part of the 'Project File Handler' component.
# It reads a configuration from a project file and executes a command specified within it.
def load_and_execute_project_command(project_file_path):
    """
    Parses a project file and runs the specified build command.
    """
    config = configparser.ConfigParser()
    config.read(project_file_path)

    # The project file can be manipulated by an attacker.
    # It is expected to contain a command under the [build] section.
    try:
        command_to_run = config.get('build', 'command')
        
        # VULNERABILITY: The 'command_to_run' string, which is read from an
        # untrusted project file, is passed directly to a shell. An attacker
        # can inject arbitrary OS commands by crafting a malicious project file.
        # For example, if command = "build.sh; rm -rf /", both commands would execute.
        subprocess.Popen(command_to_run, shell=True)

    except (configparser.NoSectionError, configparser.NoOptionError):
        # Handle cases where the config is malformed or missing the command
        print("Build command not found in project file.")