Only badly-written perl.

It's a bit like claiming that SQL allows for SQL injection attacks.

Well, the default open() method do perform pipe execs if you prepend or append "|", just like here.

http://docstore.mik.ua/orelly/perl3/prog/ch16_03.htm

If you're not using two-argument open() in Perl 5, you deserve what you get.

"If you're not using two-argument open() in Perl 5, you deserve what you get."

Pretty sure that's not quite what you meant to say...

http://modernperlbooks.com/mt/2010/04/three-arg-open-migrati...

If you _are_ using two-arg open, or if you're _not_ using three-arg open.

(Or, the more general case: "If you're using Perl you deserve what you get - if you don't understand all the language features you're using." (And feel free to substitute whatever language will start the argument in place of Perl in that claim...)

If you're not using fork, dup2, execve instead of popen, you deserve what you get.

To be fair, I agree there's some bad code in there, and no real mention of any security concerns. Not good!