CVE-2026-41083

The quoting of stdin/stdout/stderror using "Filename.quotecommand" on Windows is not sufficient, and allows the "&" character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed...