DEBIAN-CVE-2010-2246

feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL...

feh 1.7 - '--wget-Timestamp' Remote Code Execution

source: https://www.securityfocus.com/bid/41161/info feh is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer...