CVE-2020-36655: Command injection in yiisoft/yii2-gii

The vulnerability stems from improper input validation in the validateMessageCategory method. The commit diff shows the fix added a regex pattern (\w+) to restrict messageCategory values, proving the original implementation lacked proper sanitization. Attackers could exploit this by supplying a crafted messageCategory containing PHP code termination characters (like ') followed by malicious code, which would then be embedded in generated model files. The validateMessageCategory() function was the primary validation gatekeeper for this input, making it the root vulnerable function.