The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed. https://nvd.nist.gov/vuln/detail/CVE-2015-8239
