Unverified50% confidenceFactExact time
In the command injection Java case, four of the six models passed the mount argument to ProcessBuilder as a list, while Qwen3.8-Max and Kimi-K3 built strings for sh -c, causing the shell to interpret user input as commands.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
Unverified.sh脚本中的反斜杠是Shell的行续符，使带有大量参数的命令可以分多行书写67% similarUnverifiedIn languages such as C and Java, curly braces {} are the true basis for delimiting code blocks, and indentation is merely a formatting style.60% similarUnverifiedItanium has 64 1-bit predicate registers (p0–p63), and almost all instructions can carry a predicate condition prefix to enable predication.59% similarUnverifiedAdding max will widen the LanguageModelV4CallOptions['reasoning'] type and the ReasoningLevel type derived from it58% similarUnverifiedThe kimi-2-6-code project is written in TypeScript.57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1047293API
curl https://kongchang.com/api/v1/knowledge/claims/1047293MCP
get_claim(id=1047293)