Using shell=True with subprocess passes the command to the shell, allowing injection.
Use shell=False (default) and pass arguments as a list to avoid shell injection.