Congratulations. You found the actual exploit. http://git.savannah.gnu.org/cgit/patch.git/tree/src/pch.c#n2383 http://git.savannah.gnu.org/cgit/patch.git/tree/

Congratulations. You found the actual exploit. http://git.savannah.gnu.org/cgit/patch.git/tree/src/pch.c#n2383 http://git.savannah.gnu.org/cgit/patch.git/tree/src/pch.c#n2... patch calls /bin/ed. /bin/ed has a ! command that feeds stuff to /bin/sh. Feeding unreviewed patches to the patch command is actually arbitrary command execution. This is particularly awesome if patch is being used by other programs (i.e. a CI pipeline or other contexts).