This is called 'shell command injection' and is a very common attack on software. Part of the standard https://specifications.freedesktop.org/thumbnail-spec/th

This is called 'shell command injection' and is a very common attack on software. Part of the standard https://specifications.freedesktop.org/thumbnail-spec/thumbnail-spec-latest.html https://specifications.freedesktop.org/thumbnail-spec/thumbn... I believe that this would be part of GnomeDesktopThumbnailFactory , probably https://gitlab.gnome.org/GNOME/gnome-desktop/-/blob/master/libgnome-desktop/gnome-desktop-thumbnail-script.c https://gitlab.gnome.org/GNOME/gnome-desktop/-/blob/master/l... Looks like its working by design.