CVE-2026-32260: Insecure Shell Arg Concat Or Flawed Regexcve-2026-32260-insecure-shell-arg-concat-or-flawed-regex
Constructing shell commands by concatenating executable paths and arguments with a space without proper context-aware shell escaping can lead to command injection. Likewise, using a shell metacharacter blocklist regex that misses newlines (\\n) and carriage returns (\\r) allows attackers to supply multiline inputs and bypass validation.
