acme.sh runs arbitrary commands from a remote server

[jbo@]

Anybody using security/acme.sh might want to upgrade: security/acme.sh runs arbitrary commands from a remote server!
If you're using HiCA, you surely want to revoke & renew your certs (with a more trustworthy CA).

Instead, HiCA is stealthily crafting curl commands and piping the output to bash. acme.sh is (being tricked into?) running arbitrary code from a remote server.

See this GitHub issue: https://github.com/acmesh-official/acme.sh/issues/4659