XChat allows users to right-click on a URL that appears in an IRC discussion and select "Open in Browser." To open the URL in a browser, XChat passes it to /bin/sh. So, a malicious URL could execute arbitrary shell commands as the user running XChat. A patch for RedHat systems changes XChat to bypass the shell and execute the browser directly.
Credit:
The information has been provided by zenith parsec.
Count the appearance of character ' and you will see that at the 2nd `date` they are closed, and then reopened, so that `date` isn't escaped anymore - leaving it free to run, which it does.
With the 'Run New' type commands (that is, command %s with no 's around the %s) you get:
