Product
hagent through commit 761eec6 is vulnerable to OS command injection via the args parameter in hagent_arduino and hagent_esp32 tools.