added curl remote code exec vulnerability