I am trying to run a npm command that in turn executes another package (cypress) like e2e: cypress run. If I run this in the terminal or with shell=True it works as intended for the same environment. But since shell=True has its own security vulnerabilities and we depend on user input in the command I do not want to use it.

command = shlex.split(test_execution_script) 
#test_execution_script is derived from user input
process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

Upon using without shell=True it returns nNo version of Cypress is installed in: /home/ramas/.cache/Cypress/13.9.0/CypressnnPlease reinstall Cypress by running: cypress installnn----------nnCypress executable not found at: /home/ramas/.cache/Cypress/13.9.0/Cypress/Cypressnn----------nnPlatform: linux-x64 (Ubuntu - 22.04)nCypress Version: 13.9.0n

I tried string.split() as well as shlex.split(string) and the split list is as expected and using shell=True returns desired results.