fix(security): prevent command injection via shell=True (CWE-78)

fix(security): prevent command injection via shell=True (CWE-78) #3585