These look like the only problem, this is a security issue as it allows for unprivileged users to pass in shell escapes. Please change this to run with shell=False