Comment 2 for bug 746731

Thanks for reporting this issue ! Could you point to the user data that could be used unescaped in that command ? I couldn't find an obvious path. Setting to Medium importance, but ready to escalate to High/Critical if there is an exploitation path.