Patched code sample

import subprocess
import shlex

def run_python(code: str):
    """
    Executes a string of Python code in a secure manner, demonstrating the
    fix for a command injection vulnerability.

    The vulnerability (CVE-2026-34937) was caused by using `shell=True` with an
    improperly sanitized, user-controlled string. The fix is to avoid the
    shell entirely for command execution by passing arguments as a sequence.

    By setting `shell=False` (which is the default) and passing the command
    and its arguments as a list (`['python3', '-c', code]`), the user-provided
    `code` string is treated as a single argument to `python3 -c` and is not
    interpreted by the shell. This prevents shell metacharacters like `$` or
    backticks from being executed as commands.
    """
    try:
        # The command and its arguments are passed as a list.
        # `shell=False` is the default and is the secure way to call subprocesses
        # when arguments are involved, as it prevents shell injection.
        command_args = ["python3", "-c", code]

        result = subprocess.run(
            command_args,
            capture_output=True,
            text=True,
            check=False,  # Do not raise exception for non-zero exit codes
            timeout=10    # Add a timeout for safety
        )
        return result.stdout, result.stderr
    except subprocess.TimeoutExpired:
        return "", "Error: Code execution timed out after 10 seconds."
    except Exception as e:
        return "", f"An unexpected error occurred: {e}"