Comment by CGamesPlay

Not trying to throw shade at curl, although I don’t think this feature can realistically be done by a drive-by contributor.

No, the article listed some apps that were not vulnerable, and the first question to me is “so what is vulnerable?” And the answer is “every curl | sh installer on the internet since April 2025” (among assuredly many other less prolific apps).