Exactly. It's an option injection attack. There's no shell involved.