fix: sanitize subprocess call in _exiftool.py

[orbisai0security]

Summary

Fix critical severity security issue in packages/markitdown/src/markitdown/converters/_exiftool.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	packages/markitdown/src/markitdown/converters/_exiftool.py:41
CWE	CWE-22

Description: The ExifTool converter passes user-controlled file paths to subprocess.run() without proper validation. While the code uses a list format (not shell=True), the local_path variable comes from user input and could contain malicious filenames. If the file path contains special characters or is manipulated through path traversal, it could lead to unintended file access or command execution through ExifTool's own command parsing.

Changes

• packages/markitdown/src/markitdown/converters/_exiftool.py

Verification

• Build not verified
• Scanner re-scan not performed
• LLM code review not performed

---

Automated security fix by OrbisAI Security