Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Symfony Mailer selects a transport via the MAILER_DSN environment variable / configuration (e.g. smtp://…, sendmail://…, native://default). SendmailTransport invokes the local sendmail binary and supports two modes: -bs (speak SMTP over stdin: the default) and -t (read the message on stdin, pass recipients as command-line arguments). In -t mode, recipient addresses are appended to the sendmail command line without a – end-of-options separator. A recipient address beginning with - (which Symfony\Component\Mime\Address …