“It allows writing to arbitrary files, allowing the execution of arbitrary code on any Pagure instance.”
One argument injection in Pagure gave code execution on the server holding the source of every Fedora package. An attacker could have changed any package’s build scripts or patches. Red Hat patched production within hours. A whole distribution’s supply chain hung on one git forge.