Merge pull request #8875 from Smartappli/Security-Issue-Fix

CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)

packages/syft/src/syft/node/node.py

@@ -11,6 +11,7 @@
 from pathlib import Path
 import shutil
 import subprocess # nosec
+import sys
 import tempfile
 from time import sleep
 import traceback
@@ -221,10 +222,17 @@ def in_kubernetes() -> bool:
 
 
 def get_venv_packages() -> str:
- res = subprocess.getoutput(
- "pip list --format=freeze",
- )
- return res
+ try:
+ # subprocess call is safe because it uses a fully qualified path and fixed arguments
+ result = subprocess.run(
+ [sys.executable, "-m", "pip", "list", "--format=freeze"], # nosec
+ capture_output=True,
+ check=True,
+ text=True,
+ )
+ return result.stdout
+ except subprocess.CalledProcessError as e:
+ return f"An error occurred: {e.stderr}"
 
 
 def get_syft_worker() -> bool: