We are thinking of offering mutt for our member's email client. The user's shell is instead the mutt application launched on their Maildir
folder. It works great so far but one huge problem is the shell-escape feature. This would allow users to execute arbitrary code on the system using shell-builtins.
Is there a way to disable the shell-escape in mutt? Otherwise we are thinking of using Alpine and hope that does not have a shell-escape feature as well.