Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
{ "urgency": "not yet assigned" }