The vulnerability in RURBAN GD before version 2.86 arises from the use of Perl's 2-argument open() in GD::Image::_make_filehandle, which does not properly neutralize special characters in filename arguments. Filenames that begin or end with pipe characters ("| cmd", "cmd |") or redirection operators ("> path", ">> path") are executed as OS commands or cause file redirection instead of being safely opened as files. This affects all constructors that accept filenames, enabling an attacker who can supply untrusted input as a filename to execute arbitrary OS commands or overwrite files with the privileges of the running process. The in-memory data variants that do not open files are not vulnerable.

An attacker who can supply untrusted input to any filename-accepting constructor in GD before 2.86 can execute arbitrary OS commands or truncate files with the privileges of the process running the Perl GD module. This can lead to unauthorized command execution and potential system compromise or data loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to any GD filename-accepting constructors (new, newFromPng, newFromJpeg, etc.). Use the in-memory *Data variants that do not open files if possible. Monitor vendor channels for updates and apply official patches once released.