OS Command injection in github.com/kardianos/service

service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory.

The validity of this vulnerability has been questioned and the reporter has requested that the CVE be disputed.