Command injection via batch filename suffix bypass

Argument injection in Rust before 1.81.0 allows attackers to execute arbitrary commands through crafted Windows batch invocations. std::process::Command checks the unnormalized program name for a .bat or .cmd suffix, while Windows strips trailing spaces and periods before resolving the path, so a disguised batch filename bypasses cmd.exe argument escaping. Exploitation requires code or a dependency to invoke such a filename on Windows and pass attacker-controlled arguments; other platforms and ordinary executable invocations are unaffected.