Command execution via shell-concatenated compiler arguments

Command injection in the szc compiler driver in Stabilizer allows local users to execute arbitrary commands via crafted compiler arguments. The arg helper and build stages concatenate output names, input filenames, and pass-through flags into shell command strings that os.system() executes without quoting or validation. Exploitation requires local access to invoke szc and control its arguments or build inputs; injected commands run with the privileges of the szc process.