Nope, it's not necessary. Test it with a vulnerable CGI app and call: subprocess.call(["date"]) Or if bash is not your default shell: subprocess.call(["bash"

Nope, it's not necessary. Test it with a vulnerable CGI app and call: subprocess.call(["date"]) Or if bash is not your default shell: subprocess.call(["bash", "-c", "date"])