lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23935.json"