> The bug is not technically a 0day for rxvt-unicode and has been known at > least since 2017-05-01 when it was discussed publicly in oss-security Какая милота ёпт.

The victim must enter a command to run a program

@mugiseyebrows > PoC