A local subprocess is a separate process started on the same machine by another application. The parent app may launch it to handle a task, run a helper tool, or invoke a command with specific arguments. Because it runs locally, it inherits the host’s permissions, environment, and access to files and network resources available to that user or service account.
In cyber security, subprocess creation matters because it can turn data into action. If an application reads untrusted content and uses it to decide what to execute, an attacker may trigger command launch, parameter injection, or unauthorized tool use. Defenders watch for unexpected process starts, especially from viewers, parsers, or editors that should only display content. Hardening steps include validating inputs, avoiding shell interpretation, restricting allowed commands, and running risky file handling in a sandbox. In notebook and AI-assisted tools, a hidden setting or metadata field can be enough to start a local subprocess before the user runs any visible code.