PT-2026-50717

The quoting of stdin/stdout/stderror using Filename.quote command on Windows is not sufficient, and allows the & character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed. Exploit bash $ opam exec --...