Command Injection inside the ping command about grass HOT 1 CLOSED

You are correct, there is indeed a vulnerability in the ping command and we certifiy that your exploit works. 🥇

However, let me make some clarifications:

While we have an escape function as you noticed, one of our programmers somehow forgot to call it for the ping command.

Morover, this escape function only escapes quotes in a given string, which is an intended behavior. The idea is to put escaped user-supplied arguments bash commands between quotes to prevent the execution of unintended additional commands. As an example, have a look at the cd command which does not suffer from the same vulnerability:

from grass.