CVE-2024-27763: XPixelGroup BasicSR Command Injection

The vulnerability stems from line 44 in dist_util.py where subprocess.getoutput(f'scontrol show hostname {node_list} | head -n1') directly interpolates the SLURM_NODELIST environment variable into a shell command. As node_list is user-controlled through environment variables without validation/sanitization, attackers can inject arbitrary commands through command substitution characters. The function _init_dist_slurm handles SLURM cluster initialization and is the only location where this vulnerable command construction occurs, as evidenced by the referenced code snippets and advisory details.