Comment by phonethrowaway

they don't even address shell escape injection which is definitely possible...