OS Command Injection

rake is vulnerable to OS command injection. The vulnerability exists as it improperly handles the value of the command file name in Rake::FileList, allowing OS command injection when list.egrep is called with a malicious file name such as | touch evil.txt...