2017/10/GHSA-99ch-8mvp-g7m5 md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename