CVE-2017-1000116: Mercurial is vulnerable to shell injection attack

The vulnerability stems from improper sanitization of hostnames in SSH URLs. The _make_ssh_cmd function is responsible for building the SSH connection command. Prior to version 4.3, this function likely concatenated raw hostname input into the command string without proper shell escaping. Security advisories explicitly mention SSH command injection through malicious hostnames, and standard secure coding practices would require adding shell quoting (e.g., via util.shellquote()) around the hostname parameter - a fix implemented in the patched version 4.3.