Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.