OpenVPN on Windows before versions 2.6.14 and 2.7.5 is affected by an OS command injection issue. The wide_cmd_line() function in src/openvpn/win32.c only quoted command-line arguments that contained a space, leaving cmd.exe metacharacters (& | < > ^ % ( ) !) unquoted. Because CreateProcess() runs .bat and .cmd scripts through cmd.exe, a crafted X.509 certificate subject passed to a hook script such as --tls-verify could be reinterpreted by cmd.exe and start a second command (CERT VU#123335). This issue affects only OpenVPN on Windows.