Language: Python
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
def run_command(cmd, log_output=False):
    """
    Return (exitcode, output) of executing the provided `cmd` in a shell.
    `cmd` can be provided as a string or as a list of arguments.

    If `log_output` is True, the stdout and stderr of the process will be captured
    and streamed to the `logger`.
    """
    if isinstance(cmd, list):
        cmd = " ".join(cmd)

    if not log_output:
        exitcode, output = subprocess.getstatusoutput(cmd)
        return exitcode, output

    process = subprocess.Popen(
        cmd,
        shell=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        universal_newlines=True,
    )

    while _stream_process(process):
        sleep(1)

    exitcode = process.poll()
    return exitcode, ""