Plugin bin directories are now validated against shell metacharacters before being added to PATH. Paths containing dangerous characters are dropped with a warning: "Dropping plugin bin path with shell metacharacters."
Evidence
Bin path security (search for "Dropping plugin bin path with shell metacharacters")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
