From a7e1784b88865da668476d4ff6260fb58906eae3 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Tue, 8 Sep 2026 01:09:40 +0000
Subject: [PATCH] fix(security): autofix Unsafe subprocess usage can lead to
 remote code execution

---
 elastalert/alerts.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/elastalert/alerts.py b/elastalert/alerts.py
index 099702e82..d617a4991 100644
--- a/elastalert/alerts.py
+++ b/elastalert/alerts.py
@@ -4,6 +4,7 @@
 import json
 import logging
 import os
+import re
 import subprocess
 import sys
 import time
@@ -895,6 +896,11 @@ def alert(self, matches):
         except KeyError as e:
             raise EAException("Error formatting command: %s" % (e))
 
+        # Validate command arguments
+        for command_arg in command:
+            if not re.match(r'^[a-zA-Z0-9_\-./\\]+$', command_arg):
+                raise EAException("Invalid command argument: %s" % (command_arg))
+
         # Run command and pipe data
         try:
             subp = subprocess.Popen(command, stdin=subprocess.PIPE, shell=self.shell)