fix: sanitize subprocess call in java_stdio_evaluator.py

[anupamme]

Summary

Fix critical severity security issue in yaksh/java_stdio_evaluator.py.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	yaksh/java_stdio_evaluator.py:66
Assessment	Likely exploitable

Description: The JavaStdIOEvaluator class uses subprocess.Popen with shell=True to compile and execute user-submitted Java code. Malicious Java code can use Runtime.getRuntime().exec() or native methods to execute arbitrary system commands on the server.

Evidence

Exploitation scenario: An attacker submits Java code containing Runtime.getRuntime().exec("rm -rf /") or similar malicious commands.

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• yaksh/java_stdio_evaluator.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security