JOE's tag-search feature (default keybinding ^K ;) reads a file literally named `tags` from the current working directory and parses whitespace-separated tag entries. The extracted FILE value is passed unchanged to JOE's internal file loader, which preserves a feature where filenames beginning with `!` are executed as shell commands via `/bin/sh -c`. Because the tag-file parser performs no validation of the FILE token, a crafted `tags` file whose FILE field begins with `!` triggers arbitrary command execution as the user running JOE the moment the victim performs a tag search that matches the malicious key. Affected components: joe/utag.c (dotag, dotagjump), joe/b.c (bfind, bload). Affected editors: joe, jmacs, jpico, jstar. The restricted editor rjoe is not exposed by default.