2017/10/GHSA-p673-hjf2-pwfr Shell command injection in command_wrap