PAR101

Unquoted inputs to paramiko exec_command() can leave the remote host vulnerable to shell injection.

Applies to :

• SSHClient.exec_command()
• Channel.exec_command()

Notes

• String literals are ok
• Call expressions or reference expressions are treated as “unsafe” unless escaped

Quick Fixes

• Shell Escape Fixer

Fixes

Use shlex.quote surrounding any input, e.g.

import paramiko
import shlex

client = paramiko.SSHClient(...)
ret = client.exec_command(shlex.quote(input))