Launchpad.net

CVE 2013-7416

canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.

See the CVE page on Mitre.org for more details.