Command Injection on tinygltf

An attacker can craft an untrusted path within a glTF input file. When the library processes this path, the `wordexp()` function will expand it, potentially executing arbitrary commands. This vulnerability is triggered during the file path processing stage of the glTF loading mechanism. The expansion allows for command injection through the use of backticks within the path [ref_id=1].

The vulnerability lies in the use of the `wordexp()` function for processing paths within the tinygltf library. The commit associated with this fix specifically targets the removal of this function call, indicating that the relevant code path involves file path handling during glTF asset loading [ref_id=2].

The fix removes the call to the `wordexp()` function for expanding file paths. The commit message states that file path expansion is not necessary for glTF asset paths and disabling it removes the security risk associated with `wordexp()` [ref_id=2]. This change prevents the library from interpreting special shell characters in paths, thereby mitigating the command injection vulnerability.