Advisories for Gem/Flash_tool package

If files downloaded contain shell characters it's possible to execute code as the client user