Command injection in mage-ai's add_host_to_known_hosts via unvalidated git URL parsing. Reported April 2024, patched June 2026 after 26 months of silence.