Shell characters are not stripped on external program invocation.
vulners.com/securityvulns/securityvulns:doc:4756