Maybe someone had an idea for putting a vulnerability into a GNU utility.

Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection.

Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs so you can safely construct a query string out of them.

"Hey, those web guys say sanitizing inputs is effectively impossible. Should we really be doing this?"

"Snort. That's what they say about manually deallocating memory, too."

"Oh yeah! What a bunch of wimps! I'll get right to work on the query builder."