fix shell vulnerability