Re: Structurally fixing command injection bugs

[Gregory Heytings]

> I plan to develop proof of concept code (PoC) and submit it to the 
> responsible maintainer for verifying the vulnerability and the fix. 
> Publicly disclosing PoC code is usually frowned upon, no matter how 
> trivial/exploitable the issue is.

If you're unsure what to do, you can always send a private mail to the two 
head maintainers: Eli Zaretskii <eliz@gnu.org> and Lars Ingebrigtsen 
<larsi@gnus.org>.