From this article I learned about "wordexp()" [1] -- that's a pretty cool function. But it's disappointing that the man page doesn't seem to suggest that there

From this article I learned about "wordexp()" [1] -- that's a pretty cool function. But it's disappointing that the man page doesn't seem to suggest that there's any security concern. > The expansion done consists of the following stages: tilde expansion (replacing ~user by user's home direc‐tory), variable substitution (replacing $FOO by the value of the environment variable FOO), command substi‐tution replacing $(command) or `command` by the output of command), arithmetic expansion, field splitting, wildcard expansion, quote removal. Clearly the backticks are shown here. But it's worth bringing out a separate "SECURITY" section of the manpage to make the risk clearer. [1] https://man7.org/linux/man-pages/man3/wordexp.3.html https://man7.org/linux/man-pages/man3/wordexp.3.html