The exec tool passes the model-supplied command directly to /bin/sh -c with no allowlist or sandbox.
# Reproduction steps redacted under coordinated disclosure. # Full PoC will be published with the advisory at embargo expiry. $ zds reproduce ZDS-2025-0128