The header was passed as a `--header` argument, so it was readable by anyone who could see the downloader's command line.
curl now reads it as `header = "…"` from a config on stdin (`--config -`); the sanitized value can contain neither `"` nor `\` nor a line break, so it cannot escape the quoted string or add another option.
GNU Wget only reads a config file that is a regular file, so a subshell writes the header to a `mktemp` file in `$TMPDIR` (mode 0600), after a copy of the user's `$WGETRC` or `~/.wgetrc`, which that file replaces, and points `WGETRC` at it;
traps on EXIT, HUP, INT, and TERM remove it, and `WGETRC` never reaches the user's shell.
BusyBox wget reads no config file and has no option for one, so it still gets the header as an argument; the README recommends curl on shared machines.
Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-540RL2U6.
Jordan Harband
903e349369