Xgettext

How Command Injection happens in Shell Scripts and how to fix it

A command injection vulnerability in `update-po.sh` allowed maliciously crafted filenames in `po/POTFILES.in` to be interpreted as shell commands via unquoted command substitution. The fix replaces `$(cat po/POTFILES.in)` with `xgettext`'s native `--files-from=` flag, eliminating the shell word-splitting attack surface entirely. This is a textbook example of how a single unquoted substitution can become a dangerous exploit primitive.