bug: Git commit messages with a backticks will execute as a command (`security`)

Context

During a default install of husky, when i have a commit message with a back ticks, it will execute the command between the 2 back tickets and add it to the commit message, this could lead to accidental deletion:

git commit -m "what `ls -lh`"
git log
commit bcdd487bce3fc31cde8124e861208c4f0a571a46 (HEAD -> main)
Author: Michael Brewer <[e-mail]>
Date:   Wed Jan 12 01:54:34 2022 -0800

    what total 16
    drwxr-xr-x  5 michaelbrewer  staff   160B Jan 12 01:52 node_modules
    -rw-r--r--  1 michaelbrewer  staff   902B Jan 12 01:52 package-lock.json
    -rw-r--r--  1 michaelbrewer  staff   136B Jan 12 01:54 package.json

Husky: ^7.0.4 git: 2.34.1 os: macos

Steps to reproduce

# Create blank new repo
mkdir foo
cd foo
git init

# Install and setup husky
npm install husky --save-dev
npm set-script prepare "husky install"
npm set-script test "echo 'cool cool cool'"
npm run prepare
npx husky add .husky/pre-commit "npm test"

# Use ` in a commit message and check the git log
git add package.json
git commit -m "x `ls`"
git log

[trasherdk]

Well, it’s a feature. Not a bug 😃 Command-Substitution You can have your commit message contain variables and output from a script.

Use single-quote ' around your commit message to avoid.

[r1m]

ok, typo in the message. but still newfile is not shown in the listing. That proves the command is not executed during the git log but during the message creation.

Anyway, not an husky issue