There are calls to host.run() that format command strings naively, potentially vulnerable to injection or bugs.

Example in autotest server/crashcollect.py