Advisories for Golang/Github.com/Mutagen-Io/Mutagen package

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in github.com/mutagen-io/mutagen.

Impact Mutagen projects offer shell-based execution functionality. On Windows, the shell is resolved using the standard %ComSpec% mechanism, with a fallback to a %PATH%-based search for cmd.exe. While this is the standard practice on Windows systems, it presents somewhat risky behavior. Firstly, %ComSpec% could, in theory, be set maliciously. Unfortunately, there's not much that can be done to prevent this attack surface, because %ComSpec% is the official mechanism for shell …