delegates.mgk.in file of GraphicsMagick contains this comment: Under Unix, all text (non-numeric) substitutions should be surrounded with double quotes for

delegates.mgk.in file of GraphicsMagick contains this comment: Under Unix, all text (non-numeric) substitutions should be surrounded with double quotes for the purpose of security, and because any double quotes occuring within the substituted text will be escaped using a backslash. Commands (excluding file names) containing one or more of the special characters ";&|><" (requiring that multiple processes be executed) are executed via the Unix shell with text substitutions carefully excaped to avoid possible compromise. Otherwise, commands are executed directly without use of the Unix shell. I assume GraphicsMagick doesn't suffer from this vulnerability.