Burp Suite extensions can execute arbitrary code

I hope you’re doing well. I’m reaching out to share a security concern regarding Burp Suite’s extension framework that could allow an attacker to compromise a machine by executing untrusted code. While Burp Suite offers powerful extensibility, this flexibility can also introduce significant …

   subprocess.Popen(["calc.exe"], shell=True)  # Opens Calculator
   subprocess.Popen(["notepad.exe", "poc.txt"], shell=True)  # Opens Notepad with a file
   subprocess.Popen(["start", "microsoft.windows.camera:"], shell=True)  # Opens Camera