fixed spec for remote code execution vulnerability