clamav-milter in ClamAV before 0.91.2 when run in black hole mode allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call involving the \recipient field of sendmail.\