Mailman 1.1 allows list administrators to execute arbitrary commands via shell metacharacters in the %(listname) macro expansion.
https://exchange.xforce.ibmcloud.com/vulnerabilities/5493
https://euvd.enisa.europa.eu/vulnerability/EUVD-2000-0848
http://www.securityfocus.com/bid/1667
http://archives.neohapsis.com/archives/freebsd/2000-09/0112.html
http://archives.neohapsis.com/archives/bugtraq/2000-09/0040.html