Xfce

How Command Injection happens in Python subprocess calls and how to fix it

A command injection vulnerability in `typhoon/typhoon_window.py` allowed a locally-crafted monitor name from `xrandr` output to inject arbitrary shell commands via a `subprocess.check_output()` call with `shell=True`. The fix replaces the interpolated shell string with a safe argument list, eliminating the injection surface entirely. This is a textbook example of how seemingly harmless system-integration code can become an exploitable attack vector.