They're both the same root cause. Command injection in notifications