An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options.

Vulnerable code:

def _get_nix_font_path(self, name, style):
    try:
        from commands import getstatusoutput
    except ImportError:
        from subprocess import getstatusoutput
    exit, out = getstatusoutput('fc-list "%s:style=%s" file' %
                                (name, style))
    if not exit:
        lines = out.splitlines()
        if lines:
            path = lines[0].strip().strip(':')
            return path

Upstream patch:

https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8