@@ -111,6 +111,14 @@ underlying :class:`Popen` interface can be used directly.
111
111
Added the *text * parameter, as a more understandable alias of *universal_newlines *.
112
112
Added the *capture_output * parameter.
113
113
114
+ .. versionchanged :: 3.11.2
115
+
116
+ Changed Windows shell search order for ``shell=True ``. The current
117
+ directory and ``%PATH% `` are replaced with ``%COMSPEC% `` and
118
+ ``%SystemRoot%\System32\cmd.exe ``. As a result, dropping a
119
+ malicious program named ``cmd.exe `` into a current directory no
120
+ longer works.
121
+
114
122
.. class :: CompletedProcess
115
123
116
124
The return value from :func: `run `, representing a process that has finished.
@@ -487,6 +495,14 @@ functions.
487
495
*executable * parameter accepts a bytes and :term: `path-like object `
488
496
on Windows.
489
497
498
+ .. versionchanged :: 3.11.2
499
+
500
+ Changed Windows shell search order for ``shell=True ``. The current
501
+ directory and ``%PATH% `` are replaced with ``%COMSPEC% `` and
502
+ ``%SystemRoot%\System32\cmd.exe ``. As a result, dropping a
503
+ malicious program named ``cmd.exe `` into a current directory no
504
+ longer works.
505
+
490
506
*stdin *, *stdout * and *stderr * specify the executed program's standard input,
491
507
standard output and standard error file handles, respectively. Valid values
492
508
are ``None ``, :data: `PIPE `, :data: `DEVNULL `, an existing file descriptor (a
@@ -1158,6 +1174,14 @@ calls these functions.
1158
1174
.. versionchanged :: 3.3
1159
1175
*timeout * was added.
1160
1176
1177
+ .. versionchanged :: 3.11.2
1178
+
1179
+ Changed Windows shell search order for ``shell=True ``. The current
1180
+ directory and ``%PATH% `` are replaced with ``%COMSPEC% `` and
1181
+ ``%SystemRoot%\System32\cmd.exe ``. As a result, dropping a
1182
+ malicious program named ``cmd.exe `` into a current directory no
1183
+ longer works.
1184
+
1161
1185
.. function :: check_call(args, *, stdin=None, stdout=None, stderr=None, \
1162
1186
shell=False, cwd=None, timeout=None, \
1163
1187
**other_popen_kwargs)
@@ -1190,6 +1214,14 @@ calls these functions.
1190
1214
.. versionchanged :: 3.3
1191
1215
*timeout * was added.
1192
1216
1217
+ .. versionchanged :: 3.11.2
1218
+
1219
+ Changed Windows shell search order for ``shell=True ``. The current
1220
+ directory and ``%PATH% `` are replaced with ``%COMSPEC% `` and
1221
+ ``%SystemRoot%\System32\cmd.exe ``. As a result, dropping a
1222
+ malicious program named ``cmd.exe `` into a current directory no
1223
+ longer works.
1224
+
1193
1225
1194
1226
.. function :: check_output(args, *, stdin=None, stderr=None, shell=False, \
1195
1227
cwd=None, encoding=None, errors=None, \
@@ -1245,6 +1277,14 @@ calls these functions.
1245
1277
.. versionadded :: 3.7
1246
1278
*text * was added as a more readable alias for *universal_newlines *.
1247
1279
1280
+ .. versionchanged :: 3.11.2
1281
+
1282
+ Changed Windows shell search order for ``shell=True ``. The current
1283
+ directory and ``%PATH% `` are replaced with ``%COMSPEC% `` and
1284
+ ``%SystemRoot%\System32\cmd.exe ``. As a result, dropping a
1285
+ malicious program named ``cmd.exe `` into a current directory no
1286
+ longer works.
1287
+
1248
1288
1249
1289
.. _subprocess-replacements :
1250
1290
0 commit comments