os.system() with user input allows arbitrary command execution.
Use subprocess.run() with a list of arguments and shell=False instead of os.system().