Maybe you are running this on a machine that is not really accessible to "untrusted" clients? I certainly hope so, because for any web script that is generally accessible, interpolating cgi params directly into a string that is being interpreted by a shell is asking for trouble. Even for limited-access jobs, this is something that really should be avoided -- at least do some sanity checks on the params first.

Apart from that, even if this is only accessible to "trusted" clients, there might be an issue about how many clients might hit the script at a given time (or how many times one client might hit it in rapid succession), causing lots of long, heavy processes to be running concurrently on the server. Good luck with that.