Controlling arguments without shell often still leads to RCE though, because a lot of software has some flag that runs some command

https://0x90909090.blogspot.com/2015/07/no-one-expect-comman...