Local code execution via unescaped tutorial paths

Code injection in NVIDIA Megatron Bridge before 0.2.2 allows local users to execute arbitrary commands through its data-shuffling tutorial. The tutorial builds a shell command from user-controlled source and output paths and passes it to subprocess.run with shell=True, allowing shell metacharacters to escape the intended split, shuf, and awk pipeline. A low-privileged local user must supply the tutorial inputs; execution uses the tutorial process's privileges and can expose or alter data or elevate privileges when that process has greater rights.