Local code execution via unchecked savelayout command

Command injection in Astropy 5.3.2 allows local users to execute code by passing a crafted savelayout value to TransformGraph.to_dot_graph. The method places the unvalidated value at argv[0] for subprocess.Popen, so an executable or script runs before a later data-type error is raised. Exploitation requires local access to invoke affected library code or control a caller's savelayout input, and the spawned process runs with the caller's privileges.