emacs -- arbitary shell command execution vulnerability of ctags

lu4nx reports:

    GNU Emacs through 28.2 allows attackers to execute
    commands via shell metacharacters in the name of a
    source-code file, because lib-src/etags.c uses the system
    C library function in its implementation of the ctags
    program. For example, a victim may use the "ctags *"
    command (suggested in the ctags documentation) in a
    situation where the current working directory has contents
    that depend on untrusted input.