Debian Linux Security Advisory 4650-1 - Miguel Onoro reported that qbittorrent, a bittorrent client with a Qt5 GUI user interface, allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, which could result in remote command execution via a crafted name within an RSS feed if qbittorrent is configured to run an external program on torrent completion.
81ce00615031776c64f048ce089f6f75f331fe3f4abddb5f9e3c4aa3270399ac