In manager.c in ss-manager in shadowsocks-libev 3.1.0 improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic related to the add_server build_config and construct_command_line functions.