Command injection notice

[fdevans]

No description provided.

[Copilot]

Pull Request Overview

This PR introduces a new security advisory for a command injection vulnerability in job options due to incomplete escaping, and updates the CVE index to include it.

• Added a new entry to the CVE index for the “Command Injection via Job Options” advisory
• Created 2025-07-option-escaping.md with full advisory details

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
docs/history/cves/index.md	Added new “Command Injection via Job Options” entry
docs/history/cves/2025-07-option-escaping.md	New advisory document describing the escaping vulnerability

Comments suppressed due to low confidence (3)

docs/history/cves/index.md:16

• [nitpick] The description uses "in" while the link title uses "via". Consider aligning this wording to "via" to match the advisory title and file name.

    Command Injection in Job Options Due to Incomplete Escaping

docs/history/cves/2025-07-option-escaping.md:6

• [nitpick] The heading uses "in" but the advisory title and index entry use "via." Update this to "Command Injection via Job Options Due to Incomplete Escaping" for consistency.

## **Security Advisory: Command Injection in Job Options Due to Incomplete Escaping**

docs/history/cves/2025-07-option-escaping.md:14

• [nitpick] Section headings are bolded here but other advisories typically use plain headings. Remove the extra bold formatting (e.g., change ## **Description** to ## Description) to match the established style.

## **Description**