I haven't experimented yet, but I wouldn't be surprise if something seemingly innocuous like nzbget is vulnerable. It shells out to various extra processing scr

I haven't experimented yet, but I wouldn't be surprise if something seemingly innocuous like nzbget is vulnerable. It shells out to various extra processing scripts, setting a bunch of variables from the downloaded nzb file. How about all those torrent clients? Do they safely shell out when doing transcoding stuff? I don't know - do you? How about the absurd rube goldberg contraption that is modern email processing? How about all of those scripts that crawl various web pages? Do they shell out anything, or set environment variables? Not just the ones you wrote, but any of the ones that are potentially being used within your organization? (it just takes one owned box in the network to gain a foothold)