fix: sanitize subprocess call in run_crew.py

[orbisai0security]

Summary

Fix critical severity security issue in lib/crewai/src/crewai/cli/run_crew.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	lib/crewai/src/crewai/cli/run_crew.py:72

Description: The CLI modules run_crew.py, train_crew.py, and cli.py invoke subprocess.run() with Bandit S603 security warnings explicitly suppressed using 'noqa: S603' comments. The 'command' variable passed to these calls is constructed from CLI arguments or configuration values. If user-controlled input such as crew names, task parameters, or environment variables is incorporated into the command list without strict allowlist validation, an attacker can inject shell metacharacters or additional commands. The deliberate suppression of Bandit warnings indicates these calls were flagged and the warnings were silenced rather than the underlying issue resolved, suggesting the security risk was known but deferred.

Changes

• lib/crewai/src/crewai/cli/run_crew.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security