A Remote Code Execution can be acheived via TranformGraph().to_dot_graph function in astropy prior to 5.3.3. Due to improper input validation a malicious user can provide a command or a script file as a value to savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. Although an error will be raised, the command or script will be executed successfully.