Comment by craigds

shell=True is a security risk unless you're very careful with escaping inputs. In this case any filename with a `;` in it (or various other shell characters) will run arbitrary commands on the attacker's computer.

best to pass a list of arguments to subprocess rather than a string, and avoid shell=True