Thor before 1.4.0 can construct an unsafe shell command from library input.
{ "urgency": "not yet assigned" }