popen with a variable or concatenated command string can execute injected shell commands.
Replace popen with a direct exec of a fixed program and sanitized arguments.